Editable Secure Controls Framework (SCF) Policies & Standards Template

The Digital Security Program (DSP) has complete coverage for the Secure Controls Framework (SCF). The DSP is an enterprise-class solution for cybersecurity & data privacy documentation consisting of thirty-three (33) domains that defines a modern, digital security program. Specifically:

• Policies have 1-1 coverage for each SCF domain
• Control objectives have 1-1 coverage for each SCF control
• Standards have 1-1 coverage for each SCF control
• Guidelines have 1-1 coverage for each SCF control
• Controls (Secure Controls Framework)
• Metrics (Cybersecurity Metrics Reporting Model)

The DSP leverages the Secure Controls Framework (SCF), which is a metaframework that map to over 100 cybersecurity & data privacy laws, regulations and frameworks. The SCF's integration into the DSP provides mapped risks, threats, maturity criteria and much more to make it the most robust solution on the market!

The DSP's policies & standards have direct, 1-1 mapping to the SCF's controls. The DSP leverages several key SCF components to provide “more than just policies & standards” by incorporating maturity criteria, a threat catalog, a risk catalog and more! The DSP provides invaluable content to operationalize several of the SCF's notable capabilities:

• Cybersecurity & Data Privacy (C|P) Principles
• Data Privacy Management Principles (DPMP)
• Cybersecurity & Data Privacy Capability Maturity Model (C|P-CMM) 
• Cybersecurity & Data Privacy Risk Management Model (C|P-RMM)

What Problems Does The DSP Solve?  

• Lack of In House Security Experience - Writing security documentation is a skill that many good cybersecurity professionals simply are not proficient at and avoid the task at all cost. Tasking your security analysts and engineers to write comprehensive documentation means you are actively taking them away from protecting and defending your network, which is not a wise use of their time. The DSP is an efficient method to obtain comprehensive security policies, standards, controls and metrics for your organization!
• Compliance Requirements - Nearly every organization, regardless of industry, is required to have formally-documented security policies and standards. Requirements range from PCI DSS to HIPAA to NIST 800-171. The DSP is designed with compliance in mind, since it focuses on leading security frameworks to address reasonably-expected security requirements.
• Audit Failures - Security documentation does not age gracefully like a fine wine. Outdated documentation leads to gaps that expose organizations to audit failures and system compromises. The DSP's standards provides mapping to leading security frameworks to show you exactly what is required to both stay secure and compliant.  
• Vendor Requirements - It is very common for clients and partners to request evidence of a security program and this includes policies and standards. The DSP provides this evidence!

How Does the DSP Solve These Problems?

• Clear Documentation - The DSP provides comprehensive documentation to prove that your security program exists. This equates to a time saving of hundreds of hours and tens of thousands of dollars in staff and consultant expenses!
• Time Savings - The DSP can provide your organization with a semi-customized solution that requires minimal resources to fine tune for your organization's specific needs. 
• Alignment With Leading Practices - The DSP is written to support over one hundred laws, regulations and industry frameworks! 

The DSP and its corresponding Cybersecurity Operating Procedures (CSOP), come together to provide "premium GRC content" that enables an organization to establish or refresh its GRC practices. They cover GRC policies, GRC standards, GRC metrics and more. The following documents are valuable resources to justify purchasing the DSP to advance your GRC practices:

• ComplianceForge Reference Model – Hierarchical Cybersecurity Governance Framework – Level setting on how the various types of documentation support each other. This provides insights into the definitions used, since there is a tendency within the industry to abuse definitions around policy, standard, procedure, etc. This is the hierarchical structure we follow to build our content so it is scalable and based on industry practices.
• Integrated Controls Management (ICM) - This is a "how to GRC playbook" that can help you establish the steps necessary to design, build and implement viable GRC processes. These are the steps we will tell you to follow if we were brought in to provide professional services. This helps explain further integration between the policies and standards within the DSP, corresponding procedures within the CSOP and controls from the SCF.
• Instructions & Best Practices For Using The DSP – This is a "start here" guide for using the DSP that provides a baseline for what the DSP's documentation components are and how to tailor the DSP for your specific needs.
• Security Metrics Reporting Model (SMRM) – This is the metrics model we developed as a way to leverage the built-in metrics that come as part of the DSP.
• DSP & CSOP Content Examples - This is a content example that shows two side-by-side examples from policies all the way to metrics.
• Unified Scoping Guide (USG) – Understanding control applicability is important and this scoping guide is designed to address any type of sensitive or regulated data so the appropriate controls can be applied.

Similar to our framework-specific Cybersecurity & Data Protection Program (CDPP) products, the DSP provides alignment with the underlying cybersecurity standards that must be complied with, as stipulated by statutory, regulatory and contractual requirements. However, the DSP provides robust coverage for over 100 laws, regulations and other cybersecurity and privacy frameworks. The DSP is essentially a "superset" of ISO 27002, NIST CSF, NIST 800-171, NIST 800-53 and other frameworks for organizations that do not want to be locked into alignment with just one framework [scroll to the bottom of the page to see a list of everything the DSP currently maps to]. 

Cybersecurity & Data Privacy Policies, Standards, Controls & Metrics For A Modern Company - Hierarchical & Scalable!

ComplianceForge provides organizations with exactly what they need to protect themselves - professionally written cybersecurity policies, control objectives, standards, controls, procedures and guidelines at a very affordable cost. The DSP can be found in medium and large organizations that range from Fortune 500 companies, to US and international government agencies, universities and other organizations that have complex compliance requirements and need an efficient, scalable solution for their Governance, Risk & Compliance (GRC) needs.

The Digital Security Program (DSP) is footnoted to provide authoritative references for the statutory, regulatory and contractual requirements that need to be addressed. Just as Human Resources publishes an “employee handbook” to let employees know what is expected for employees from a HR perspective, the DSP does this from a cybersecurity perspective.

The Cybersecurity Standardized Operating Procedures (CSOP) is available that provides mapped procedures to the DSP's standards. This is a 1-1 mapping with a procedure for each standard.

Example SCF Policies & Standards

Our customers choose the Digital Security Program (DSP) because they need a scalable and comprehensive solution. The DSP is a hybrid, "best in class" approach to cybersecurity documentation that covers dozens of statutory, regulatory and contractual frameworks to create a comprehensive set of cybersecurity policies, standards, controls and metrics. The DSP has a 1-1 mapping relationship with the Secure Controls Framework (SCF) so it maps to over 100 leading practices! To understand the differences between the DSP and CDPP, please visit here for more details.

View Product Examples

 

What Is Included With The DSP?

Cost Savings Estimate For The Digital Security Program (DSP) - A Fraction Of The Time & Expense 

When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing the DSP from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:

• For your internal staff to generate comparable documentation, it would take them an estimated 900 internal staff work hours, which equates to a cost of approximately $90,000 in staff-related expenses. This is about 12-24 months of development time where your staff would be diverted from other work.
• If you hire a consultant to generate this documentation, it would take them an estimated 800 consultant work hours, which equates to a cost of approximately $260,000. This is about 6-12 months of development time for a contractor to provide you with the deliverable.
• The DSP is approximately 4% of the cost for a consultant or 12% of the cost of your internal staff to generate equivalent documentation.
• We process most orders the same business day so you can potentially start working with the DSP the same day you place your order.

The process of writing cybersecurity documentation can take an internal team many months and it involves pulling your most senior and experienced cybersecurity experts away from operational duties to assist in the process, which is generally not the most efficient use of their time. In addition to the immense cost of hiring a cybersecurity consultant at $300/hr+ to write this documentation for you, the time to schedule a consultant, provide guidance and get the deliverable product can take months. Even when you bring in a consultant, this also requires involvement from your internal team for quality control and answering questions, so the impact is not limited to just the consultant's time being consumed.

• C-SCRM & NIST 800-161 R1

  For many cybersecurity practitioners, even those well versed in NIST 800-171 and Cybersecurity Matur...

• Secure Software Development Attestation

  Can you tell the difference in these secure software development attestation forms? There isn't one...

• NIST 800-171 R3 ODPs

  ComplianceForge released NIST 800-171 R3 documentation updated to address DoD-provided Organization-...

• SCF Training & Certifications

  ComplianceForge is a Licensed Content Provider (LCP) for the Secure Controls Framework (SC...

---