Program Management (PM) templates

• Program Management PolicyPOL-PM

  In this policy, the CISO sets the Organization's requirements for program management in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• Program Management ProcedurePROC-PM

  The people named in this procedure use it to carry out the PM control family policy (POL-PM). It covers every control in the program management family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.

• Enterprise Architecture PolicyPOL-EA-001

  This policy states how the Organization describes its missions, data, applications, technology, and security as one architecture. It also states how the Organization uses that architecture to decide what IT to buy, build, change, and retire.

• Information System Security Policy (ISSP)POL-ISSP-001

  The CISO issues this policy to set the rules for protecting the Organization's information and information systems. In it, the CISO:

• IT Governance and Investment Management PolicyPOL-ITGOV-001

  This policy states how the Organization decides which IT to buy, build, keep, and retire. It also states who approves each decision. The CIO owns the policy. The CIO uses it to give the agency head one view of every dollar the Organization spends on IT.

• Policy and Procedure Management PolicyPOL-DOC-001

  This policy covers how the Office of the Chief Information Security Officer writes, approves, publishes, reviews, and retires its documents. It applies to every policy, standard, procedure, standard operating procedure, plan, template, and reference document that office issues.

• Super Intelligence (SI) Governance and Acquisition PolicyPOL-AI-001
• Enterprise Architecture ProcedurePROC-EA-001

  The Chief Architect, the Chief Information Security Officer (CISO), the Senior Agency Official for Privacy (SAOP), the Chief Data Officer (CDO), System Owners, and program offices use this procedure. It covers every system and IT service the policy covers.

• IT Governance and Investment Management ProcedurePROC-ITGOV-001

  The CIO, the Chief Financial Officer (CFO), the Chief Acquisition Officer (CAO), the Chief Operating Officer (COO), and program offices use this procedure. It covers every IT resource the policy covers. Each step names the actor, the tool, the evidence the actor keeps, and the controls the step supports.

• Information Security Program PlanISPP-001

  In this Information Security Program Plan (ISPP), the CISO sets out the framework for the information security program at the Organization. The ISPP covers how the Organization protects information and information systems under these authorities:

• Privacy Continuous Monitoring StrategyPLAN-PCM-001

  The privacy continuous monitoring program keeps the SAOP aware of privacy risks at all times. It watches for changes to systems and their environments that affect personally identifiable information (PII).

• Privacy Program PlanPLAN-PRIV-001
• Risk Management StrategyPLAN-RMS-001

  The strategy states how the Organization frames, assesses, responds to, and monitors cybersecurity and privacy risk. It applies to every system the Organization owns or uses, including systems that contractors and cloud providers run for it.

• Supply Chain Risk Management Strategy and Implementation PlanPLAN-SCRM-001

  The Organization manages supply chain risk to:

• IG FISMA Metric AlignmentREF-FISMA-001

  The Inspector General evaluates the security program each year against the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics. This document is the one cross-reference between those metrics and the Organization's policies and procedures.

• Cybersecurity Framework Organizational Profile TemplateTMPL-CSF-001

  An Organizational Profile describes the Organization's current and target cybersecurity posture in terms of the CSF 2.0 outcomes. The Current Profile records the outcomes the Organization achieves today and how well. The Target Profile records the outcomes it wants to achieve, and their priority.

• Cybersecurity Risk Register TemplateTMPL-RISKREG-001

Every type and control family in the library