Plan templates for federal agencies
Plans, strategies, and the Inspector General metric reference.
- Agency Logging PlanPLAN-LOG-001
The CISO uses this plan to deploy and maintain the two logging capabilities that M-26-14 requires of the Organization:
- Breach Response PlanPLAN-BR-001
- End-of-Support Edge Device Inventory and Decommission PlanPLAN-EOS-001
Vendors no longer release security fixes for an end-of-support edge device, and attackers target boundary devices first. The CISO uses this plan to find these devices in the Organization, remove them, and keep them from coming back.
- Incident Response PlanPLAN-IR-001
The Organization uses this plan to detect, report, and respond to incidents. The plan covers the structure of the incident response capability, the incidents the Organization reports, the reports and their deadlines, the measures of the capability, and the resources it needs.
- Information Security Continuous Monitoring (ISCM) StrategyPLAN-ISCM-001
- Information Security Program PlanISPP-001
In this Information Security Program Plan (ISPP), the CISO sets out the framework for the information security program at the Organization. The ISPP covers how the Organization protects information and information systems under these authorities:
- Post-Quantum Cryptography Migration PlanPLAN-PQC-001
This document is the Organization's PQC Migration Plan. The CISO sends it to OMB and ONCD at PQC@omb.eop.gov.
- Privacy Continuous Monitoring StrategyPLAN-PCM-001
The privacy continuous monitoring program keeps the SAOP aware of privacy risks at all times. It watches for changes to systems and their environments that affect personally identifiable information (PII).
- Privacy Program PlanPLAN-PRIV-001
- Risk Management StrategyPLAN-RMS-001
The strategy states how the Organization frames, assesses, responds to, and monitors cybersecurity and privacy risk. It applies to every system the Organization owns or uses, including systems that contractors and cloud providers run for it.
- Role-Based Training and Cybersecurity Workforce PlanPLAN-WF-001
The CISO uses this plan to make sure that each person with security or privacy duties has the skills those duties need, and that the Organization knows where it lacks them. It covers:
- Supply Chain Risk Management Strategy and Implementation PlanPLAN-SCRM-001
The Organization manages supply chain risk to:
- Zero Trust and ICAM Implementation PlanPLAN-ZT-001
The Organization follows this plan to:
- IG FISMA Metric AlignmentREF-FISMA-001
The Inspector General evaluates the security program each year against the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics. This document is the one cross-reference between those metrics and the Organization's policies and procedures.