Procedure templates for federal agencies
Procedures with the steps, the people who take them, and the records each step leaves.
- Access Control ProcedurePROC-AC
The people named in this procedure use it to carry out the AC control family policy (POL-AC). It covers every control in the access control family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Awareness and Training ProcedurePROC-AT
The people named in this procedure use it to carry out the AT control family policy (POL-AT). It covers every control in the awareness and training family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Audit and Accountability ProcedurePROC-AU
The people named in this procedure use it to carry out the AU control family policy (POL-AU). It covers every control in the audit and accountability family.
- Assessment, Authorization, and Monitoring ProcedurePROC-CA
The people named in this procedure use it to carry out the CA control family policy (POL-CA). It covers every control in the assessment, authorization, and monitoring family.
- Configuration Management ProcedurePROC-CM
The people named in this procedure use it to carry out the CM control family policy (POL-CM). It covers every control in the configuration management family.
- Contingency Planning ProcedurePROC-CP
The people named in this procedure use it to carry out the CP control family policy (POL-CP). It covers every control in the contingency planning family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Identification and Authentication ProcedurePROC-IA
The people named in this procedure use it to carry out the IA control family policy (POL-IA). It covers every control in the identification and authentication family.
- Incident Response ProcedurePROC-IR
The people named in this procedure use it to carry out the IR control family policy (POL-IR). It covers every control in the incident response family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Maintenance ProcedurePROC-MA
The people named in this procedure use it to carry out the MA control family policy (POL-MA). It covers every control in the maintenance family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Media Protection ProcedurePROC-MP
The people named in this procedure use it to carry out the MP control family policy (POL-MP). It covers every control in the media protection family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Physical and Environmental Protection ProcedurePROC-PE
The people named in this procedure use it to carry out the PE control family policy (POL-PE). It covers every control in the physical and environmental protection family.
- Planning ProcedurePROC-PL
The people named in this procedure use it to carry out the PL control family policy (POL-PL). It covers every control in the planning family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls.
- Program Management ProcedurePROC-PM
The people named in this procedure use it to carry out the PM control family policy (POL-PM). It covers every control in the program management family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Personnel Security ProcedurePROC-PS
The people named in this procedure use it to carry out the PS control family policy (POL-PS). It covers every control in the personnel security family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Personally Identifiable Information Processing and Transparency ProcedurePROC-PT
The people named in this procedure use it to carry out the PT control family policy (POL-PT). It covers every control in the personally identifiable information processing and transparency family.
- Risk Assessment ProcedurePROC-RA
The people named in this procedure use it to carry out the RA control family policy (POL-RA). It covers every control in the risk assessment family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- System and Services Acquisition ProcedurePROC-SA
The people named in this procedure use it to carry out the SA control family policy (POL-SA). It covers every control in the system and services acquisition family.
- System and Communications Protection ProcedurePROC-SC
The people named in this procedure use it to carry out the SC control family policy (POL-SC). It covers every control in the system and communications protection family.
- System and Information Integrity ProcedurePROC-SI
The people named in this procedure use it to carry out the SI control family policy (POL-SI). It covers every control in the system and information integrity family.
- Supply Chain Risk Management ProcedurePROC-SR
The people named in this procedure use it to carry out the SR control family policy (POL-SR). It covers every control in the supply chain risk management family.
- CUI Challenges and Misuse Reporting ProcedurePROC-CUI-004
Use this procedure to bring and answer a challenge to a CUI designation, and to report and look into misuse of CUI. It covers challenges and reports from personnel and from authorized holders outside the Organization.
- CUI Decontrol and Destruction ProcedurePROC-CUI-003
Use this procedure to decontrol CUI, to release formerly controlled information, to destroy CUI, and to transfer CUI records to the National Archives and Records Administration (NARA). It covers CUI the Organization designated and CUI it holds from others.
- CUI Marking ProcedurePROC-CUI-001
Use this procedure to designate information as CUI, mark it, re-mark legacy documents, and fix markings that are wrong or missing. It covers every document, email, file, system screen, and container that holds CUI the Organization designates.
- CUI Safeguarding and Dissemination ProcedurePROC-CUI-002
Use this procedure to store, send, copy, and share CUI, and to set up the systems and agreements that hold it. It covers CUI in paper and electronic form, inside and outside the Organization's facilities.
- CUI Waivers and Self-Inspection ProcedurePROC-CUI-005
Use this procedure to ask for, decide, record, and end waivers of CUI requirements, and to run the yearly self-inspection and report to ISOO. It covers every part of the CUI program.
- Enterprise Architecture ProcedurePROC-EA-001
The Chief Architect, the Chief Information Security Officer (CISO), the Senior Agency Official for Privacy (SAOP), the Chief Data Officer (CDO), System Owners, and program offices use this procedure. It covers every system and IT service the policy covers.
- IPv6 Transition ProcedurePROC-IPV6-001
Use this procedure to measure IPv6 readiness, keep the IPv6 integration plan, buy IPv6-capable products, move systems to IPv6-only, keep security monitoring equal for IPv6, handle waivers, and report progress. It covers every networked system and Internet Protocol (IP)-enabled asset in the scope of the IPv6 Policy.
- IT Asset Management ProcedurePROC-ITAM-001
The CIO owns this procedure, and the CISO concurs. It covers every IT asset in the scope of the IT Asset Management Policy, at every stage of its life. Each step names the person who acts, the action, the tool, the record it leaves, and the NIST SP 800-53 controls it supports.
- IT Governance and Investment Management ProcedurePROC-ITGOV-001
The CIO, the Chief Financial Officer (CFO), the Chief Acquisition Officer (CAO), the Chief Operating Officer (COO), and program offices use this procedure. It covers every IT resource the policy covers. Each step names the actor, the tool, the evidence the actor keeps, and the controls the step supports.
- Mobile Device ProcedurePROC-MOB-001
Use this procedure to issue, enroll, update, and recover mobile devices, approve apps, prepare devices for international travel, keep messages as records, and review the program each year. It covers smartphones and tablets, government-furnished or personally owned. Its travel steps also cover laptops.
- Plan of Action and Milestones (POA&M) Management ProcedurePROC-POAM-001
The Information System Security Officer (ISSO) uses a POA&M item to track one weakness. The item states what is wrong, the risk it poses, the corrective action, the resources needed, the owner, and the milestones to closure. Authorizing Officials use POA&M data for risk decisions.
- Unmanned Aircraft Systems Security ProcedurePROC-UAS-001
A UAS carries sensors, storage, radios, and software, and it often connects to a vendor cloud. It is an information system in its own right. The CISO and the people named below use this procedure so that the Organization evaluates and authorizes a UAS like any other system before it commits money.
- Vulnerability Management ProcedurePROC-VM-001
Use this procedure to find vulnerabilities, set a due date for each one, fix or isolate it, confirm the fix, and report to CISA.