Find answers to the most common questions about ComplianceForge products, ordering, customization, and cybersecurity documentation. Can't find your answer? Contact us and we'll respond as soon as we can.
Will AI make audits obsolete?
Artificial Intelligence (AI) will not make cybersecurity audits obsolete, but AI will change how they are conducted.
What Is The Secure Engineering & Data Protection (SEDP)?
The Secure Engineering & Data Protection (SEDP) package is ComplianceForge’s editable documentation for secure engineering, privacy by design and data…
The Secure Baseline Configuration (SBC) is ComplianceForge’s editable documentation for defining and maintaining approved, hardened configuration baselines for…
A Risk Management Program (RMP) is essentially a "risk management playbook" for how your organization addresses the broader concepts of risk management that…
What is the purpose of compliance policies and procedures?
The purpose of compliance policies and procedures is to provide documented guidance to employees that can ensure adherence to applicable laws, regulations and…
The PCI DSS Policies & Standards package is ComplianceForge’s editable documentation for organizations that need policies and standards aligned to Payment Card…
The NIST Cybersecurity Framework (CSF) version of the CDPP is ComplianceForge’s editable policy and standards documentation aligned to NIST CSF outcomes.
What Is The NIST 800-53 R5 Low, Moderate & High Baseline Version Of The CSOP?
The NIST SP 800-53 Rev. 5 Low, Moderate & High baseline version of the CSOP is ComplianceForge’s editable procedure set aligned to NIST 800-53 controls across…
What Is The NIST 800-53 R5 Low, Moderate & High Baseline Version Of The CDPP?
The NIST SP 800-53 Rev. 5 Low, Moderate & High baseline version of the CDPP is ComplianceForge’s editable policy and standards documentation aligned to the…
What Is The NIST 800-53 R5 Low & Moderate Baseline Version Of The CSOP?
The NIST SP 800-53 Rev. 5 Low & Moderate baseline version of the CSOP is ComplianceForge’s editable procedure documentation aligned to Low and Moderate NIST…
What Is The NIST 800-53 R5 Low & Moderate Baseline Version Of The CDPP?
The NIST SP 800-53 Rev. 5 Low & Moderate baseline version of the CDPP is ComplianceForge’s editable policy and standards documentation aligned to NIST SP…
What Is The NIST 800-171 System Security Plan (SSP)?
The NIST 800-171 System Security Plan (SSP) is a required living document that describes the system boundary, environment of operation and how NIST SP 800-171…
What Is The NIST 800 171 Compliance Program (NCP)?
The NIST 800-171 Compliance Program (NCP) is ComplianceForge’s editable documentation package for organizations that need to implement and evidence NIST SP…
The ISO 27001 framework was developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) and…
What is the ISO 27001 / 27002 version of the CSOP?
The ISO 27001 / 27002 version of the Cybersecurity Standardized Operating Procedures (CSOP) is ComplianceForge’s editable procedure-template package designed…
What is the ISO 27001 / 27002 version of the CDPP?
The ISO 27001 / 27002 version of the Cybersecurity & Data Protection Program (CDPP) is ComplianceForge’s editable policy and standards documentation aligned to…
What Is The Integrated Incident Response Program (IIRP)?
The Integrated Incident Response Program (IIRP) is ComplianceForge’s editable incident response documentation package for organizing cybersecurity incident…
The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, is a US Federal law that primarily governs the handling and…
The DSP / SCF version of the Cybersecurity Standardized Operating Procedures (CSOP) is an editable procedure-template package aligned to the Secure Controls…
What is the difference between strategic planning and operational planning?
Strategic planning defines what the organization is trying to achieve over a multi-year horizon. Operational planning figures out how to actually run the…
What is the difference between strategic and tactical planning?
Strategic planning sets direction over years. Tactical planning addresses the next 30 to 90 days. They're not just different timeframes - they require…
There are many differences between a policy and a law: Laws are external to an organization (e.g., issued by a government), while policies are internal to an…
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 and ISO 27002 are both international frameworks related to cybersecurity, where: ISO 27001 specifies the requirements for establishing, implementing,…
The Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS) are regulatory frameworks governing how the US…
What is the difference between a process and a procedure?
The difference between a process and procedures is about structure, where you can have a process without a procedure, but you cannot have a procedure without a…
What Is The Cybersecurity Supply Chain Risk Management (C-SCRM)?
Cybersecurity Supply Chain Risk Management (C-SCRM) is the process of identifying, assessing, responding to and monitoring cybersecurity risks that originate…
The Cybersecurity Risk Assessment (CRA) is ComplianceForge’s editable risk assessment package for identifying, evaluating and documenting cybersecurity risks…
The Cybersecurity Business Plan (CBP) is ComplianceForge’s editable template for CISOs, cybersecurity directors and security program leaders who need to…
"Tactical operations" is an imprecise term that blends two distinct planning levels. It shows up frequently in job descriptions and project plans when the…
Supply Chain Risk Management (SCRM) is the process of identifying, assessing and mitigating risks within a company's supply chain to ensure continuity of…
What is Supply Chain Risk Management (SCRM) in Cybersecurity?
Supply Chain Risk Management in cybersecurity is also referred to as C-SCRM (Cyber Supply Chain Risk Management). It addresses the security risks that enter…
Strategy and Operations are two levels of planning and action within an organization, especially relevant in cybersecurity and business management contexts.
A statutory obligation is a legal duty created by legislation - a requirement that exists because a legislature passed a law, independent of any contract or…
The term “SOX Cybersecurity” refers to the compliance-related cybersecurity practices and controls implemented to comply with the Sarbanes-Oxley Act (SOX), a…
Secure Software Development (SSD) refers to the process of designing, coding, testing and deploying software with built-in security controls to minimize…
The terms risk, threat and vulnerability are core elements in risk analysis, each representing a distinct concept: Risk: A situation where someone or something…
Risk management in network security is the process of identifying, assessing, prioritizing and mitigating risks to network infrastructure, data and services…
The terms “risk appetite” and “risk tolerance” are foundational concepts in risk management, helping organizations define how much risk they’re willing to…
Risk acceptance in cybersecurity refers to the conscious decision by an organization’s leadership to acknowledge and accept the potential consequences of a…
The NIST CSF refers to the NIST Cybersecurity Framework (CSF), a voluntary, risk-based approach developed by the National Institute of Standards and Technology…
NIST Special Publication 800-53 is a comprehensive catalog of security and privacy controls developed by the National Institute of Standards and Technology…
NIST Special Publication 800-171 is a set of cybersecurity requirements published by the National Institute of Standards and Technology (NIST) that applies to…
NIST Special Publication 800-161 is a foundational cybersecurity guidance document developed by the National Institute of Standards and Technology (NIST).
ITAR/EAR are two (2) different, but complementary sets of requirements: ITAR is an acronym for International Traffic in Arms Regulations; and EAR is an acronym…
Integrity in information security means that data is accurate, complete and unmodified except through authorized processes. It's the property you're protecting…
ICM stands for Integrated Controls Management, a model that emphasizes controls as the central pivot of any cybersecurity and data privacy program. ICM uses…
Governance, Risk and Compliance (GRC) is an integrated approach to managing cybersecurity obligations. The order the acronym implies, however, is the wrong…
Digital security is synonymous with “IT security” and “cybersecurity” that focuses on protecting digital devices, networks, data and users from unauthorized…
Data Privacy Management is an internal cybersecurity or data privacy function that provides oversight for how personal and sensitive information is collected,…
Cybersecurity GRC is the governance, risk management and compliance function within a security department. It manages policies, tracks control effectiveness…
Cybersecurity Governance is the set of responsibilities, practices and processes exercised by an organization’s leadership to provide oversight of the…
Controlled Unclassified Information (CUI) is a US Government construct created under Executive Order 13556 (2010) that effectively replaces For Official Use…
The term “Compliance Governance” is a misnomer, where it is more accurately called “Compliance Oversight” that refers to the processes in place ensure that an…
CIS generally refers to the Center for Internet Security, renowned for its Critical Security Controls (CSC) and CIS Benchmarks: CIS Controls: A prioritized…
Availability in information security means that systems, data and services are accessible to authorized users when they're needed. It's the most operationally…
A Vulnerability Management Program is a continuous process organizations use to identify, assess, prioritize and remediate vulnerabilities and threats.
