Policy templates for federal agencies
Policies, the secure configuration standard, and the rules of behavior that users sign.
- Access Control PolicyPOL-AC
In this policy, the CISO sets the Organization's requirements for access control in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Awareness and Training PolicyPOL-AT
In this policy, the CISO sets the Organization's requirements for awareness and training in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Audit and Accountability PolicyPOL-AU
In this policy, the CISO sets the Organization's requirements for audit and accountability in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Assessment, Authorization, and Monitoring PolicyPOL-CA
In this policy, the CISO sets the Organization's requirements for assessment, authorization, and monitoring in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Configuration Management PolicyPOL-CM
In this policy, the CISO sets the Organization's requirements for configuration management in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Contingency Planning PolicyPOL-CP
In this policy, the CISO sets the Organization's requirements for contingency planning in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Identification and Authentication PolicyPOL-IA
In this policy, the CISO sets the Organization's requirements for identification and authentication in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Incident Response PolicyPOL-IR
In this policy, the CISO sets the Organization's requirements for incident response in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Maintenance PolicyPOL-MA
In this policy, the CISO sets the Organization's requirements for maintenance in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Media Protection PolicyPOL-MP
In this policy, the CISO sets the Organization's requirements for media protection in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Physical and Environmental Protection PolicyPOL-PE
In this policy, the CISO sets the Organization's requirements for physical and environmental protection in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Planning PolicyPOL-PL
In this policy, the CISO sets the Organization's requirements for planning in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Program Management PolicyPOL-PM
In this policy, the CISO sets the Organization's requirements for program management in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Personnel Security PolicyPOL-PS
In this policy, the CISO sets the Organization's requirements for personnel security in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Personally Identifiable Information Processing and Transparency PolicyPOL-PT
In this policy, the Senior Agency Official for Privacy (SAOP) sets the Organization's requirements for personally identifiable information processing and transparency in every information system that the Organization operates or that others operate for it. The SAOP issues the policy under these authorities:
- Risk Assessment PolicyPOL-RA
In this policy, the CISO sets the Organization's requirements for risk assessment in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- System and Services Acquisition PolicyPOL-SA
In this policy, the CISO sets the Organization's requirements for system and services acquisition in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- System and Communications Protection PolicyPOL-SC
In this policy, the CISO sets the Organization's requirements for system and communications protection in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- System and Information Integrity PolicyPOL-SI
In this policy, the CISO sets the Organization's requirements for system and information integrity in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Supply Chain Risk Management PolicyPOL-SR
In this policy, the CISO sets the Organization's requirements for supply chain risk management in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Controlled Unclassified Information (CUI) PolicyPOL-CUI-001
- Enterprise Architecture PolicyPOL-EA-001
This policy states how the Organization describes its missions, data, applications, technology, and security as one architecture. It also states how the Organization uses that architecture to decide what IT to buy, build, change, and retire.
- Information System Security Policy (ISSP)POL-ISSP-001
The CISO issues this policy to set the rules for protecting the Organization's information and information systems. In it, the CISO:
- Internet Protocol Version 6 (IPv6) PolicyPOL-IPV6-001
- IT Asset Management PolicyPOL-ITAM-001
The Organization manages its IT assets so that it can:
- IT Governance and Investment Management PolicyPOL-ITGOV-001
This policy states how the Organization decides which IT to buy, build, keep, and retire. It also states who approves each decision. The CIO owns the policy. The CIO uses it to give the agency head one view of every dollar the Organization spends on IT.
- Large Language Model Procurement RequirementsPOL-LLM-001
- Mobile Device PolicyPOL-MOB-001
- Policy and Procedure Management PolicyPOL-DOC-001
This policy covers how the Office of the Chief Information Security Officer writes, approves, publishes, reviews, and retires its documents. It applies to every policy, standard, procedure, standard operating procedure, plan, template, and reference document that office issues.
- Social Security Number Collection and Use PolicyPOL-SSN-001
- Software and Hardware Assurance PolicyPOL-SWHW-001
- Super Intelligence (SI) Governance and Acquisition PolicyPOL-AI-001
- Vulnerability Disclosure PolicyPOL-VDP-001
- Vulnerability Management PolicyPOL-VM-001
- Secure Configuration Baseline StandardSTD-CFG-001
This standard tells staff how the Organization chooses, approves, applies, checks, and fixes the secure configuration of each component. It covers every component in every system the Organization owns or that others run for it:
- Rules of Behavior — General UsersROB-GEN-001
- Rules of Behavior — Privileged UsersROB-PRIV-001