Program artifact checklist
Every artifact this guide has a template for, in one list: 92 documents across the four stages of the program path (Foundation 15, Core 46, Operate 27, Mature 4). It is generated from the templates themselves, so it grows with the kit. Use it to track which documents your program has adopted, who owns each, and what is still to do.
Download: Program artifact checklist (.csv): the table below, with each template’s address and empty columns for your own status, owner, target date and notes. The full kit includes it.
How to read it
Section titled “How to read it”- Stage: when a new program should adopt the artifact. Each stage’s page, linked from the Stage column, says what the stage achieves and which decisions it needs.
- Controls: the SP 800-53 controls the artifact satisfies or supports. A policy and its decision worksheet show the family’s -1 control, which the policy’s common sections meet; the policy’s page lists every control it has statements for. The consolidated policy shows the -1 control of every family it covers.
- Accountable role: for a policy and its worksheet, the role the policy holds accountable. For a plan, standard, procedure, form or report, the role its template names as accountable for it, such as the system owner for a system’s own documents; a template that names none shows the role accountable for the family policy of its first-listed control. Assign each artifact to a named person in your program.
- Status: the template’s status in this guide: Draft until the author has reviewed it. It says nothing about your program; the spreadsheet’s own columns are for that.
Policies come two ways: the Information Security and Privacy Policy covers every family in one document, and the family policies cover one family each. For any one scope, adopt one or the other, not both, and track the one you adopt. The decision worksheets serve either.
Artifacts
Section titled “Artifacts”| Artifact | Type | Stage | Controls | Accountable role | Status |
|---|---|---|---|---|---|
| Information Security and Privacy Policy | Policy | Foundation | AC-1, AT-1, AU-1, CA-1, CM-1, CP-1, IA-1, IR-1, MA-1, MP-1, PE-1, PL-1, PM-1, PS-1, PT-1, RA-1, SA-1, SC-1, SI-1, SR-1 | Chief Information Security Officer | Draft |
| Planning Policy | Policy | Foundation | PL-1 | Chief Information Security Officer | Draft |
| Program Management Policy | Policy | Foundation | PM-1 | Chief Information Security Officer | Draft |
| Risk Assessment Policy | Policy | Foundation | RA-1 | Chief Information Security Officer | Draft |
| Planning Decision Worksheet | Decision worksheet | Foundation | PL-1 | Chief Information Security Officer | Draft |
| Program Management Decision Worksheet | Decision worksheet | Foundation | PM-1 | Chief Information Security Officer | Draft |
| Risk Assessment Decision Worksheet | Decision worksheet | Foundation | RA-1 | Chief Information Security Officer | Draft |
| Information Security Program Plan | Plan | Foundation | PM-1, PM-2, PM-3, PM-6, PM-10, PM-29 | Chief Information Security Officer | Draft |
| Risk Management Strategy | Plan | Foundation | PM-9, PM-28, PM-29, PM-31 | Chief Information Security Officer | Draft |
| System Security Plan | Plan | Foundation | PL-2, RA-2, CM-8, CA-3, CA-5 | System owner | Draft |
| Risk Register | Form or register | Foundation | RA-3, RA-7 | System owner | Draft |
| Rules of Behavior | Form or register | Foundation | PL-4, PL-4(1), PE-17 | Chief Information Security Officer | Draft |
| Security Categorization Worksheet | Form or register | Foundation | RA-2 | System owner | Draft |
| System Inventory | Form or register | Foundation | PM-5, PM-5(1) | Chief Information Security Officer | Draft |
| Risk Assessment Report | Report | Foundation | RA-3, RA-3(1) | System owner | Draft |
| Access Control Policy | Policy | Core | AC-1 | Chief Information Security Officer | Draft |
| Audit and Accountability Policy | Policy | Core | AU-1 | Chief Information Security Officer | Draft |
| Awareness and Training Policy | Policy | Core | AT-1 | Chief Information Security Officer | Draft |
| Configuration Management Policy | Policy | Core | CM-1 | Chief Information Security Officer | Draft |
| Contingency Planning Policy | Policy | Core | CP-1 | Chief Information Security Officer | Draft |
| Identification and Authentication Policy | Policy | Core | IA-1 | Chief Information Security Officer | Draft |
| Incident Response Policy | Policy | Core | IR-1 | Chief Information Security Officer | Draft |
| Personally Identifiable Information Processing and Transparency Policy | Policy | Core | PT-1 | Senior privacy official | Draft |
| Personnel Security Policy | Policy | Core | PS-1 | Chief Information Security Officer | Draft |
| System and Communications Protection Policy | Policy | Core | SC-1 | Chief Information Security Officer | Draft |
| Access Control Decision Worksheet | Decision worksheet | Core | AC-1 | Chief Information Security Officer | Draft |
| Audit and Accountability Decision Worksheet | Decision worksheet | Core | AU-1 | Chief Information Security Officer | Draft |
| Awareness and Training Decision Worksheet | Decision worksheet | Core | AT-1 | Chief Information Security Officer | Draft |
| Configuration Management Decision Worksheet | Decision worksheet | Core | CM-1 | Chief Information Security Officer | Draft |
| Contingency Planning Decision Worksheet | Decision worksheet | Core | CP-1 | Chief Information Security Officer | Draft |
| Identification and Authentication Decision Worksheet | Decision worksheet | Core | IA-1 | Chief Information Security Officer | Draft |
| Incident Response Decision Worksheet | Decision worksheet | Core | IR-1 | Chief Information Security Officer | Draft |
| Personally Identifiable Information Processing and Transparency Decision Worksheet | Decision worksheet | Core | PT-1 | Senior privacy official | Draft |
| Personnel Security Decision Worksheet | Decision worksheet | Core | PS-1 | Chief Information Security Officer | Draft |
| System and Communications Protection Decision Worksheet | Decision worksheet | Core | SC-1 | Chief Information Security Officer | Draft |
| Configuration Management Plan | Plan | Core | CM-9, CM-1, CM-2, CM-2(3), CM-3, CM-3(1), CM-3(4), CM-5 | System owner | Draft |
| Incident Response Plan | Plan | Core | IR-8, IR-8(1), IR-4, IR-5, IR-6, IR-7, IR-2, IR-3 | Chief Information Security Officer | Draft |
| Information System Contingency Plan | Plan | Core | CP-2, CP-2(1), CP-2(3), CP-2(8), CP-6, CP-7, CP-8, CP-9, CP-10 | System owner | Draft |
| Security and Privacy Training Plan | Plan | Core | AT-2, AT-2(2), AT-2(3), AT-3, AT-3(5), AT-4, PM-13, PM-14 | Chief Information Security Officer | Draft |
| Tabletop Exercise Kit | Plan | Core | IR-3, IR-3(2), IR-2(3), IR-4, IR-8 | Chief Information Security Officer | Draft |
| Audit Logging Standard | Standard | Core | AU-2, AU-3, AU-3(1), AU-3(3), AU-4, AU-5, AU-8, AU-9, AU-9(4), AU-11, AU-12, AU-5(1), AU-5(2), AU-9(2), AU-9(3), AU-10, AU-12(1), AU-12(3) | Chief Information Security Officer | Draft |
| Baseline Configuration Standard | Standard | Core | CM-6, CM-6(1), CM-6(2), CM-2, CM-2(2), CM-2(3), CM-2(7), CM-7, CM-7(1) | Chief Information Security Officer | Draft |
| Boundary Protection Standard | Standard | Core | SC-7, SC-7(3), SC-7(4), SC-7(5), SC-7(7), SC-7(8), SC-7(18), SC-7(21), AC-4 | Chief Information Security Officer | Draft |
| Encryption and Key Management Standard | Standard | Core | SC-8, SC-8(1), SC-12, SC-12(1), SC-13, SC-17, SC-28, SC-28(1) | Chief Information Security Officer | Draft |
| Identification and Authentication Standard | Standard | Core | IA-2, IA-2(1), IA-2(2), IA-2(8), IA-2(12), IA-5, IA-5(1), IA-5(2), IA-5(6), IA-3, IA-4, IA-4(4), IA-6, IA-7, IA-8, IA-8(1), IA-8(2), IA-8(4), IA-11, IA-12, AC-7 | Chief Information Security Officer | Draft |
| Remote Access Standard | Standard | Core | AC-17, AC-17(1), AC-17(2), AC-17(3), AC-17(4), AC-12, SC-10 | Chief Information Security Officer | Draft |
| Vulnerability Management Standard | Standard | Core | RA-5, RA-5(2), RA-5(4), RA-5(5), RA-5(11) | Chief Information Security Officer | Draft |
| Account Management Procedure | Procedure | Core | AC-2, AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-2(13), AC-5, AC-6(7), PS-4 | Chief Information Security Officer | Draft |
| Incident Handling Playbook | Procedure | Core | IR-4, IR-4(1), IR-5, IR-6, IR-6(1), IR-6(3), IR-7, IR-8(1) | Chief Information Security Officer | Draft |
| Log Review Procedure | Procedure | Core | AU-6, AU-6(1), AU-6(3), AU-6(5), AU-6(6), AU-7, AU-7(1) | Chief Information Security Officer | Draft |
| Access Agreement | Form or register | Core | PS-6, PS-4, PS-8, PL-4 | Chief Information Security Officer | Draft |
| Access Request Form | Form or register | Core | AC-2, AC-2(2), AC-5, AC-6, AC-6(2) | Chief Information Security Officer | Draft |
| Access Review Record | Form or register | Core | AC-2, AC-2(3), AC-5, AC-6(7) | System owner | Draft |
| Change Request Form | Form or register | Core | CM-3, CM-3(2), CM-4, CM-4(1), CM-4(2) | Chief Information Security Officer | Draft |
| Component Inventory | Form or register | Core | CM-8, CM-8(1), CM-8(2), CM-8(3), CM-8(4), PE-16, MP-7 | System owner | Draft |
| Incident Report Form | Form or register | Core | IR-6, IR-6(1), IR-5, IR-7, IR-8(1) | Chief Information Security Officer | Draft |
| Onboarding, Transfer and Termination Checklist | Form or register | Core | PS-4, PS-5, PS-3, PS-6, PS-7, AC-2, AT-2 | Human resources office | Draft |
| Privacy Notice | Form or register | Core | PT-5, PT-5(2), PM-20, PM-20(1), PT-2, PT-3, PT-4, PT-7 | Senior privacy official | Draft |
| Training Record Log | Form or register | Core | AT-4, AT-2, AT-3 | Chief Information Security Officer | Draft |
| Business Impact Analysis | Report | Core | CP-2, CP-2(3), CP-2(8) | System owner | Draft |
| Privacy Impact Assessment | Report | Core | RA-8, PT-2, PT-3, PT-4, PT-5, PT-7, PT-8, SC-7(24), RA-3 | Senior privacy official | Draft |
| Assessment, Authorization, and Monitoring Policy | Policy | Operate | CA-1 | Chief Information Security Officer | Draft |
| Maintenance Policy | Policy | Operate | MA-1 | Chief Information Security Officer | Draft |
| Media Protection Policy | Policy | Operate | MP-1 | Chief Information Security Officer | Draft |
| Physical and Environmental Protection Policy | Policy | Operate | PE-1 | Facilities manager | Draft |
| System and Information Integrity Policy | Policy | Operate | SI-1 | Chief Information Security Officer | Draft |
| System and Services Acquisition Policy | Policy | Operate | SA-1 | Chief Information Security Officer | Draft |
| Assessment, Authorization, and Monitoring Decision Worksheet | Decision worksheet | Operate | CA-1 | Chief Information Security Officer | Draft |
| Maintenance Decision Worksheet | Decision worksheet | Operate | MA-1 | Chief Information Security Officer | Draft |
| Media Protection Decision Worksheet | Decision worksheet | Operate | MP-1 | Chief Information Security Officer | Draft |
| Physical and Environmental Protection Decision Worksheet | Decision worksheet | Operate | PE-1 | Facilities manager | Draft |
| System and Information Integrity Decision Worksheet | Decision worksheet | Operate | SI-1 | Chief Information Security Officer | Draft |
| System and Services Acquisition Decision Worksheet | Decision worksheet | Operate | SA-1 | Chief Information Security Officer | Draft |
| Contingency Plan Test Plan | Plan | Operate | CP-4, CP-4(1), CP-4(2), CP-3(1), CP-9(2) | System owner | Draft |
| Continuous Monitoring Strategy | Plan | Operate | CA-7, CA-7(1), CA-7(4), PM-31, CA-2, CA-5, CA-6 | Chief Information Security Officer | Draft |
| Security and Privacy Assessment Plan | Plan | Operate | CA-2, CA-2(1), CA-2(2), CA-8, CA-7(1) | Chief Information Security Officer | Draft |
| Acquisition Security Requirements | Standard | Operate | SA-4, SA-4(1), SA-4(2), SA-4(5), SA-4(9), SA-4(10), SA-5, SA-10, SA-11, SA-15, SA-15(3), SA-22, SR-5, PS-7 | Chief Information Security Officer | Draft |
| Patch and Flaw Remediation Standard | Standard | Operate | SI-2, SI-2(2), SI-3, SI-5, SI-7(15) | Chief Information Security Officer | Draft |
| System Monitoring Standard | Standard | Operate | SI-4, SI-4(2), SI-4(4), SI-4(5), SI-4(10), SI-4(12), SI-4(14), SI-4(20), SI-4(22), AU-6, AU-11 | Chief Information Security Officer | Draft |
| External Service Review | Form or register | Operate | SA-9, SA-9(2), SA-4, CA-3, CA-5 | System owner | Draft |
| Information Exchange Agreement | Form or register | Operate | CA-3, CA-3(6), SA-9 | System owner | Draft |
| Maintenance Log | Form or register | Operate | MA-2, MA-2(2), MA-3, MA-3(1), MA-3(2), MA-3(3), MA-4, MA-4(3), MA-5, MA-5(1) | Chief Information Security Officer | Draft |
| Media Sanitization Record | Form or register | Operate | MP-6, MP-6(1), MP-6(2), MP-6(3), MP-4, MP-5, MA-2, MA-3(3) | Chief Information Security Officer | Draft |
| Physical Access List | Form or register | Operate | PE-2, PE-3, PE-3(1), PS-4, PS-5 | Facilities manager | Draft |
| Plan of Action and Milestones (POA&M) | Form or register | Operate | CA-5, CA-7, PM-4 | System owner | Draft |
| Visitor Log | Form or register | Operate | PE-8, PE-8(1), PE-8(3), PE-3 | Facilities manager | Draft |
| Contingency Plan After-Action Report | Report | Operate | CP-4, CP-2 | System owner | Draft |
| Security and Privacy Assessment Report | Report | Operate | CA-2, CA-2(1), CA-5, CA-6, CA-7 | Chief Information Security Officer | Draft |
| Supply Chain Risk Management Policy | Policy | Mature | SR-1 | Chief Information Security Officer | Draft |
| Supply Chain Risk Management Decision Worksheet | Decision worksheet | Mature | SR-1 | Chief Information Security Officer | Draft |
| Supply Chain Risk Management Plan | Plan | Mature | SR-2, SR-2(1), SR-3 | System owner | Draft |
| Supplier Assessment Questionnaire | Form or register | Mature | SR-6, SR-5, RA-3(1) | Chief Information Security Officer | Draft |
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.