Cybersecurity Policies, Standards & Procedures Bundles
Every company needs cybersecurity policies, standards and procedures to be secure and compliant. Our cybersecurity documentation bundles can save you hundreds of hours and tens of thousands of dollars! Instead of waiting months, you can have your documentation in as little as a business day! We now offer NIST SP 800-53 R5 policies, standards and procedures! We also offer policies, standards and procedures that can enable a company to align with NIST Cybersecurity Framework, ISO 27001/27002, NIST 800-171 / CMMC, NIST 800-53 and the Secure Controls Framework (SCF). These bundles are centered around our Cybersecurity & Data Protection Program (CDPP), but we do offer bundles for our Digital Security Program (DSP) for organizations that need to align with multiple frameworks.
Security by Design (SbD) Starts With Framework Alignment
Picking a cybersecurity framework is more of a business decision and less of a technical decision. Realistically, this should be driven by a fundamental understanding of what your organization needs to comply with from a statutory, regulatory and contractual perspective, since that understanding establishes the minimum set of requirements necessary to comply. This understanding makes it pretty easy to determine where on the "compliance spectrum" you need to focus for selecting a set of cybersecurity principles to follow that generally involves NIST Cybersecurity Framework, ISO 27002 or NIST 800-53 as a starting point. A key consideration for picking a cybersecurity framework comes down to the level of content the framework offers, since this governs what you can natively comply without having to bolt-on content to make it work. We currently offer framework-aligned bundles for the three most common "flavors" of cybersecurity frameworks:
To better understand how ComplianceForge products fit into your compliance needs, you can see what various frameworks expect there to be from a documentation perspective. This further supports the spectrum chart depicted above.
If you need help deciding which framework best fits your needs, you can contact us or read through this FAQ section that helps address this common question. If you do not want to be locked into a single framework, you should take a look at the Digital Security Program (DSP), since that is a hybrid approach that is designed for organizations that must address multiple statutory, regulatory and contractual requirements that a single framework might not be able to support.
Procedures Operationalize Policies & Standards - This Is A Key Concept To Being Both Secure & Audit-Ready
We leverage the Operationalizing Cybersecurity Planning Model in creating a practical view towards implementing cybersecurity requirements. Organizations are often not at a loss for a set of policies, but executing those requirements often fall short due to several reasons. Standardized Operating Procedures (SOPs) are where the rubber meets the road for Individual Contributors (ICs), since these key players need to know (1) how they fit into day-to-day operations, (2) what their priorities are and (3) what is expected from them in their duties. When looking at it from an auditability perspective, the evidence of due diligence and due care should match what the organization's cybersecurity business plan is attempting to achieve.
One of the most important things to keep in mind with procedures is that the "ownership" is different than that of policies and standards:
- Policies, standards and controls are designed to be centrally-managed at the corporate level (e.g., governance, risk & compliance team, CISO, etc.).
- Controls are assigned to stakeholders, based on applicable statutory, regulatory and contractual obligations.
- Procedures are by their very nature de-centralized, where control implementation at the team-level is defined to explain how the control is addressed (e.g., network team, desktop support, HR, procurement, etc.).
Given this approach to how documentation is structured, based on "ownership" of the documentation components:
- Policies, standards and controls are expected to be published for anyone within the organization to have access to, since it applies organization-wide. This may be centrally-managed by a GRC/IRM platform or published as a PDF on a file share, since they are relatively static with infrequent changes.
- Procedures are "living documents" that require frequent updates based on changes to technologies and staffing. Procedures are often documented in "team share" repositories, such as a wiki, SharePoint page, workflow management tool, etc.
The central focus of any procedures should be a Capability Maturity Model (CMM) target that provides quantifiable expectations for People, Processes and Technologies (PPT), since this helps prevent a “moving target” by establishing an attainable expectation for “what right looks like” in terms of PPT. Generally, cybersecurity business plans take a phased, multi-year approach to meet these CMM-based cybersecurity objectives. Those objectives, in conjunction with the business plan, demonstrate evidence of due diligence on behalf of the CISO and his/her leadership team. The objectives prioritize the organization’s service catalog through influencing procedures at the IC-level for how PPT are implemented at the tactical level. SOPs not only direct the workflow of staff personnel, but the output from those procedures provides evidence of due care.
The diagram below helps show the critical nature of documented cybersecurity procedures in keeping an organization both secure and compliant:
