Free security policy templates for federal agencies
The FedXchange library holds every security policy, procedure, plan, and form that FedXchange writes, as free templates for federal agencies. Each template rests on National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5 and cites the federal sources behind it. Each one calls the agency that adopts it "the Organization", names owners by role, and names tools by function.
How to use a template
- Pick a template by type or by control family.
- Choose the baseline that matches your highest Federal Information Processing Standards (FIPS) 199 impact level: Low, Moderate, or High.
- Choose the High Value Asset (HVA) overlay too if your agency has High Value Assets.
- Where the Federal Risk and Authorization Management Program (FedRAMP) sets a value for a parameter, the template shows that value.
- Where your agency chooses, the template shows a bracketed value for you to fill in.
- Read the full text here, or sign in free to download it as a Word, Markdown, or plain-text file.
License
You may copy, change, and share every template under the Creative Commons Attribution (CC BY) 4.0 International license, if you credit FedXchange. Adapt this template to your organization before you use it. It is not legal advice. FedXchange has no affiliation with any government agency, and no agency endorses it.
By type
- Policy templates37
Policies, the secure configuration standard, and the rules of behavior that users sign.
- Procedure templates33
Procedures with the steps, the people who take them, and the records each step leaves.
- Plan templates14
Plans, strategies, and the Inspector General metric reference.
- Templates and forms8
Forms, memoranda, agreements, and registers to fill in.
By NIST SP 800-53 control family
- Access Control (AC) 5
- Awareness and Training (AT) 3
- Audit and Accountability (AU) 3
- Assessment, Authorization, and Monitoring (CA) 6
- Configuration Management (CM) 7
- Contingency Planning (CP) 3
- Identification and Authentication (IA) 2
- Incident Response (IR) 5
- Maintenance (MA) 2
- Media Protection (MP) 8
- Physical and Environmental Protection (PE) 2
- Planning (PL) 4
- Program Management (PM) 17
- Personnel Security (PS) 2
- Personally Identifiable Information Processing and Transparency (PT) 3
- Risk Assessment (RA) 6
- System and Services Acquisition (SA) 6
- System and Communications Protection (SC) 4
- System and Information Integrity (SI) 2
- Supply Chain Risk Management (SR) 2
Every template
Policy templates
- Access Control Policy
- Awareness and Training Policy
- Audit and Accountability Policy
- Assessment, Authorization, and Monitoring Policy
- Configuration Management Policy
- Contingency Planning Policy
- Identification and Authentication Policy
- Incident Response Policy
- Maintenance Policy
- Media Protection Policy
- Physical and Environmental Protection Policy
- Planning Policy
- Program Management Policy
- Personnel Security Policy
- Personally Identifiable Information Processing and Transparency Policy
- Risk Assessment Policy
- System and Services Acquisition Policy
- System and Communications Protection Policy
- System and Information Integrity Policy
- Supply Chain Risk Management Policy
- Controlled Unclassified Information (CUI) Policy
- Enterprise Architecture Policy
- Information System Security Policy (ISSP)
- Internet Protocol Version 6 (IPv6) Policy
- IT Asset Management Policy
- IT Governance and Investment Management Policy
- Large Language Model Procurement Requirements
- Mobile Device Policy
- Policy and Procedure Management Policy
- Social Security Number Collection and Use Policy
- Software and Hardware Assurance Policy
- Super Intelligence (SI) Governance and Acquisition Policy
- Vulnerability Disclosure Policy
- Vulnerability Management Policy
- Secure Configuration Baseline Standard
- Rules of Behavior — General Users
- Rules of Behavior — Privileged Users
Procedure templates
- Access Control Procedure
- Awareness and Training Procedure
- Audit and Accountability Procedure
- Assessment, Authorization, and Monitoring Procedure
- Configuration Management Procedure
- Contingency Planning Procedure
- Identification and Authentication Procedure
- Incident Response Procedure
- Maintenance Procedure
- Media Protection Procedure
- Physical and Environmental Protection Procedure
- Planning Procedure
- Program Management Procedure
- Personnel Security Procedure
- Personally Identifiable Information Processing and Transparency Procedure
- Risk Assessment Procedure
- System and Services Acquisition Procedure
- System and Communications Protection Procedure
- System and Information Integrity Procedure
- Supply Chain Risk Management Procedure
- CUI Challenges and Misuse Reporting Procedure
- CUI Decontrol and Destruction Procedure
- CUI Marking Procedure
- CUI Safeguarding and Dissemination Procedure
- CUI Waivers and Self-Inspection Procedure
- Enterprise Architecture Procedure
- IPv6 Transition Procedure
- IT Asset Management Procedure
- IT Governance and Investment Management Procedure
- Mobile Device Procedure
- Plan of Action and Milestones (POA&M) Management Procedure
- Unmanned Aircraft Systems Security Procedure
- Vulnerability Management Procedure
Plan templates
- Agency Logging Plan
- Breach Response Plan
- End-of-Support Edge Device Inventory and Decommission Plan
- Incident Response Plan
- Information Security Continuous Monitoring (ISCM) Strategy
- Information Security Program Plan
- Post-Quantum Cryptography Migration Plan
- Privacy Continuous Monitoring Strategy
- Privacy Program Plan
- Risk Management Strategy
- Role-Based Training and Cybersecurity Workforce Plan
- Supply Chain Risk Management Strategy and Implementation Plan
- Zero Trust and ICAM Implementation Plan
- IG FISMA Metric Alignment
Templates and forms
- CUI SAO and Program Manager Designation Templates
- CUI Waiver Memorandum Template
- Cybersecurity Framework Organizational Profile Template
- Cybersecurity Risk Register Template
- Information System Contingency Plan (ISCP)
- Interconnection and Information Exchange Agreement Templates
- Post-Quantum Cryptography Roles Designation Memorandum
- Risk Assessment and FIPS 199 Categorization