ComplianceForge Documentation - Where Do I Start?

There is a lot of information on the ComplianceForge website. We publish a considerable amount of guidance documents to help our clients identify what is most appropriate for them.  

From a "start here" perspective, baselining your level of understanding is critical so that you can make "apples to apples" comparisons from an objective perspective:

• NIST CSF vs ISO 27001 / 27002 vs NIST 800-53 vs NIST 800-171 vs SCF. Understand the differences between NIST CSF, ISO 27001/27002, NIST 800-53, NIST 800-171 and the Secure Controls Framework. We put together a useful guide on that topic.
• Policies vs Standards vs Procedures. Gain an insight into the differences between policies, standards, controls, procedures and other documentation components. The Hierarchical Cybersecurity Governance Framework (HCGF) puts those concepts into a "swim lane" diagram to make it easy to understand the relationships and the authoritative definitions from sources like ISO, NIST, ISACA and AICPA.
• Statutory vs Regulatory vs Contractual Obligations. Prioritize your "must have" vs "nice to have" requirements by understanding statutory, regulatory and contractual compliance.
• Strategic vs Operational vs Tactical. From a scoping perspective, understand strategic vs operational vs tactical considerations.
• Threats vs Vulnerabilities vs Risks. Understand the differences between threats, vulnerabilities and risks to appreciate how controls are central to your cybersecurity program.

Defense Contractor-Specific Guidance

We recognize that the US Defense Industrial Base (DIB) has a lot of unique cybersecurity challenges. Therefore, we put together some helpful information that is specific to the DIB:

• NIST 800-171 Compliance - Where Do I Start?
• What Is Controlled Unclassified Information (CUI)?
• ITAR vs EAR vs FAR vs DFARS (CUI & CMMC)

Product-Related Questions

• What are the differences between the Digital Security Program (DSP) and Cybersecurity & Data Protection Program (CDPP)? 
• Do you offer multiple company discounts? (e.g., subsidiaries or franchises) 
• What industries do you serve? What client references do you have? 
• How are product updates handled?

• Efficient CMMC Scoping

  Determining the scope of controls (e.g., assessment boundary) is different than determining control...

• Are you a cyber criminal?

  As a Chief Information Security Officer (CISO) or cybersecurity director, it is likely that you been...

• New Standard For Third-Party Cybersecurity Assessments

  The release of the Cybersecurity & Data Protection Assessment Standards (CDPAS) is important to the...

• Cybersecurity Materiality & Key Controls

  There is a "materiality ecosystem" that exists within modern cybersecurity risk management discussio...

---