Find answers to the most common questions about ComplianceForge products, ordering, customization, and cybersecurity documentation. Can't find your answer? Contact us and we'll respond as soon as we can.
What is the difference between compliance and regulatory?
Regulatory requirements are a subset of compliance. Organizations face obligations from laws, regulations, contracts, and internal policies.
What is the difference between a process and a procedure?
The difference between a process and procedures is about structure, where you can have a process without a procedure, but you cannot have a procedure without a…
What Is The Cybersecurity Supply Chain Risk Management (C-SCRM)?
Cybersecurity Supply Chain Risk Management (C-SCRM) is the process of identifying, assessing, responding to and monitoring cybersecurity risks that originate…
The Cybersecurity Risk Assessment (CRA) is ComplianceForge’s editable risk assessment package for identifying, evaluating and documenting cybersecurity risks…
The Cybersecurity Business Plan (CBP) is ComplianceForge’s editable template for CISOs, cybersecurity directors and security program leaders who need to…
The CIA Triad defines the three core objectives of information security: Confidentiality, Integrity and Availability - the foundation of any cybersecurity
"Tactical operations" is an imprecise term that blends two distinct planning levels. It shows up frequently in job descriptions and project plans when the…
Supply Chain Risk Management (SCRM) is the process of identifying, assessing and mitigating risks within a company's supply chain to ensure continuity of…
What is Supply Chain Risk Management (SCRM) in Cybersecurity?
Supply Chain Risk Management in cybersecurity is also referred to as C-SCRM (Cyber Supply Chain Risk Management). It addresses the security risks that enter…
Strategy and Operations are two levels of planning and action within an organization, especially relevant in cybersecurity and business management contexts.
A statutory obligation is a legal duty created by legislation - a requirement that exists because a legislature passed a law, independent of any contract or…
A 'standard procedure' is a misnomer. In cybersecurity governance, a standard defines requirements while a procedure defines step-by-step implementation
The term “SOX Cybersecurity” refers to the compliance-related cybersecurity practices and controls implemented to comply with the Sarbanes-Oxley Act (SOX), a…
Secure Software Development (SSD) refers to the process of designing, coding, testing and deploying software with built-in security controls to minimize…
Risk tolerance defines how much risk an organization is willing to accept. It sets the threshold above which identified risks must be treated or escalated
The terms risk, threat and vulnerability are core elements in risk analysis, each representing a distinct concept: Risk: A situation where someone or something…
Risk management in network security is the process of identifying, assessing, prioritizing and mitigating risks to network infrastructure, data and services…
The terms “risk appetite” and “risk tolerance” are foundational concepts in risk management, helping organizations define how much risk they’re willing to…
Risk acceptance in cybersecurity refers to the conscious decision by an organization’s leadership to acknowledge and accept the potential consequences of a…
POAM (Plan of Actions and Milestones) tracks identified weaknesses, remediation tasks and target completion dates in NIST-based compliance programs like
The NIST CSF refers to the NIST Cybersecurity Framework (CSF), a voluntary, risk-based approach developed by the National Institute of Standards and Technology…
NIST Special Publication 800-53 is a comprehensive catalog of security and privacy controls developed by the National Institute of Standards and Technology…
NIST Special Publication 800-171 is a set of cybersecurity requirements published by the National Institute of Standards and Technology (NIST) that applies to…
NIST Special Publication 800-161 is a foundational cybersecurity guidance document developed by the National Institute of Standards and Technology (NIST).
ITAR/EAR are two (2) different, but complementary sets of requirements: ITAR is an acronym for International Traffic in Arms Regulations; and EAR is an acronym…
Integrity in information security means that data is accurate, complete and unmodified except through authorized processes. It's the property you're protecting…
ICM stands for Integrated Controls Management, a model that emphasizes controls as the central pivot of any cybersecurity and data privacy program. ICM uses…
Governance, Risk and Compliance (GRC) is an integrated approach to managing cybersecurity obligations. The order the acronym implies, however, is the wrong…
FOUO (For Official Use Only) is a US government document handling designation for sensitive but unclassified information requiring limited distribution
Digital security is synonymous with “IT security” and “cybersecurity” that focuses on protecting digital devices, networks, data and users from unauthorized…
Data Privacy Management is an internal cybersecurity or data privacy function that provides oversight for how personal and sensitive information is collected,…
Cybersecurity GRC is the governance, risk management and compliance function within a security department. It manages policies, tracks control effectiveness…
Cybersecurity Governance is the set of responsibilities, practices and processes exercised by an organization’s leadership to provide oversight of the…
Controlled Unclassified Information (CUI) is a US Government construct created under Executive Order 13556 (2010) that effectively replaces For Official Use…
CSOP (Cybersecurity Standardized Operating Procedures) is ComplianceForge's editable procedure-template package covering all major compliance frameworks.
CONOPS (Concept of Operations) is a planning document that describes a proposed system, its operational environment, stakeholder roles and intended use.
The term “Compliance Governance” is a misnomer, where it is more accurately called “Compliance Oversight” that refers to the processes in place ensure that an…
