Build your program

Build the program in four stages. Each stage produces a set of artifacts, and each artifact has a template you can adopt. Finish a stage before you lean on the next one: the policies in Core assume the roles and risk tolerance you set in Foundation.

Stage	Outcome	Main artifacts
Foundation	Accountability, risk tolerance and scope are written down	Information Security Program Plan, Risk Management Strategy, system inventory, System Security Plan
Core	The controls most systems need are required by policy and run by procedure	Family policies for access, audit, configuration, identity, incident response and more; their procedures and standards
Operate	Controls are assessed, weaknesses are tracked, and monitoring is continuous	Assessment plan and report, POA&M, Continuous Monitoring Strategy
Mature	The program manages supply chain risk and improves from its own results	Supply Chain Risk Management Plan, supplier assessments

How the stages relate to the RMF

The stages are this guide’s way of ordering the work; NIST does not define them. They follow the organization-level tasks of the RMF Prepare step in SP 800-37 Rev. 2 (tasks P-1 to P-7), which set up the roles, strategy and common controls every system then relies on. Each stage page lists the Prepare tasks it carries out. That mapping is the author’s judgment, not a NIST crosswalk.

System-level work (categorizing, selecting and assessing controls for one system) follows the seven RMF steps. The program you build here is what those steps inherit.

Using the templates

Every template comes in a ready-to-adopt and an annotated edition, in Word and Markdown. Policies come in one variant per baseline, either as one Information Security and Privacy Policy for every family or as a policy per family. Start with the decision worksheet for each family: it lists every value your organization has to choose before the policy is final. See all templates, or download the starter kit: the documents to adopt first, in one file per baseline.

To track the whole program, use the artifact checklist: every artifact with its stage, controls, accountable role and template status, downloadable as a spreadsheet.