Where Do I Start?

There is a lot of information on the ComplianceForge website. We publish a considerable amount of guidance documents to help our clients identify what is most appropriate for them.  

From a "start here" perspective, baselining your level of understanding is critical so that you can make "apples to apples" comparisons from an objective perspective:

1. NIST CSF vs ISO 27001 / 27002 vs NIST 800-53 vs NIST 800-171 vs SCF. Understand the differences between NIST CSF, ISO 27001/27002, NIST 800-53, NIST 800-171 and the Secure Controls Framework. We put together a useful guide on that topic.
2. Policies vs Standards vs Procedures. Gain an insight into the differences between policies, standards, controls, procedures and other documentation components. The Hierarchical Cybersecurity Governance Framework (HCGF) puts those concepts into a "swim lane" diagram to make it easy to understand the relationships and the authoritative definitions from sources like ISO, NIST, ISACA and AICPA.
3. Statutory vs Regulatory vs Contractual Obligations. Prioritize your "must have" vs "nice to have" requirements by understanding statutory, regulatory and contractual compliance.
4. Strategic vs Operational vs Tactical. From a scoping perspective, understand strategic vs operational vs tactical considerations.
5. Threats vs Vulnerabilities vs Risks. Understand the differences between threats, vulnerabilities and risks to appreciate how controls are central to your cybersecurity program.

Defense Contractors-Specific Guidance

We recognize that the US Defense Industrial Base (DIB) has a lot of unique cybersecurity challenges. Therefore, we put together some helpful information that is specific to the DIB:

1. NIST 800-171 Compliance - Where Do I Start?
2. What Is Controlled Unclassified Information (CUI)?
3. ITAR vs EAR vs FAR vs DFARS (CUI & CMMC)

Product-Related Questions

1. What are the differences between the Digital Security Program (DSP) and Cybersecurity & Data Protection Program (CDPP)? 
2. Do you offer multiple company discounts? (e.g., subsidiaries or franchises) 
3. What industries do you serve? What client references do you have? 
4. How are product updates handled?