Skip to content
RMF Field Guide

Templates

Each template is written once and assembled for your baseline. Download the ready-to-adopt edition to fill in, or the annotated edition to learn why each section exists. Templates are dedicated to the public domain under CC0 1.0: adopt and change them without attribution. They are not legal advice; tailor them before adoption.

Policies come two ways, from the same statements: one Information Security and Privacy Policy for every family, or a policy per family.

Download the full kit: every template, in Word and Markdown, with the decision worksheets (.zip).

To track which of these your program has adopted, use the program artifact checklist: every template with its stage, controls and accountable role, as a spreadsheet.

Policies

Section titled “Policies”
TemplateProgram stageStatus
Information Security and Privacy PolicyFoundationDraft
Access Control PolicyCoreDraft
Awareness and Training PolicyCoreDraft
Audit and Accountability PolicyCoreDraft
Assessment, Authorization, and Monitoring PolicyOperateDraft
Configuration Management PolicyCoreDraft
Contingency Planning PolicyCoreDraft
Identification and Authentication PolicyCoreDraft
Incident Response PolicyCoreDraft
Maintenance PolicyOperateDraft
Media Protection PolicyOperateDraft
Physical and Environmental Protection PolicyOperateDraft
Planning PolicyFoundationDraft
Program Management PolicyFoundationDraft
Personnel Security PolicyCoreDraft
Personally Identifiable Information Processing and Transparency PolicyCoreDraft
Risk Assessment PolicyFoundationDraft
System and Services Acquisition PolicyOperateDraft
System and Communications Protection PolicyCoreDraft
System and Information Integrity PolicyOperateDraft
Supply Chain Risk Management PolicyMatureDraft

Decision worksheets

Section titled “Decision worksheets”
TemplateProgram stageStatus
Access Control Decision WorksheetCoreDraft
Awareness and Training Decision WorksheetCoreDraft
Audit and Accountability Decision WorksheetCoreDraft
Assessment, Authorization, and Monitoring Decision WorksheetOperateDraft
Configuration Management Decision WorksheetCoreDraft
Contingency Planning Decision WorksheetCoreDraft
Identification and Authentication Decision WorksheetCoreDraft
Incident Response Decision WorksheetCoreDraft
Maintenance Decision WorksheetOperateDraft
Media Protection Decision WorksheetOperateDraft
Physical and Environmental Protection Decision WorksheetOperateDraft
Planning Decision WorksheetFoundationDraft
Program Management Decision WorksheetFoundationDraft
Personnel Security Decision WorksheetCoreDraft
Personally Identifiable Information Processing and Transparency Decision WorksheetCoreDraft
Risk Assessment Decision WorksheetFoundationDraft
System and Services Acquisition Decision WorksheetOperateDraft
System and Communications Protection Decision WorksheetCoreDraft
System and Information Integrity Decision WorksheetOperateDraft
Supply Chain Risk Management Decision WorksheetMatureDraft

Plans

Section titled “Plans”
TemplateProgram stageStatus
Configuration Management PlanCoreDraft
Information System Contingency PlanCoreDraft
Contingency Plan Test PlanOperateDraft
Continuous Monitoring StrategyOperateDraft
Incident Response PlanCoreDraft
Information Security Program PlanFoundationDraft
Risk Management StrategyFoundationDraft
Security and Privacy Assessment PlanOperateDraft
Security and Privacy Training PlanCoreDraft
Supply Chain Risk Management PlanMatureDraft
System Security PlanFoundationDraft
Tabletop Exercise KitCoreDraft

Standards

Section titled “Standards”
TemplateProgram stageStatus
Acquisition Security RequirementsOperateDraft
Audit Logging StandardCoreDraft
Baseline Configuration StandardCoreDraft
Boundary Protection StandardCoreDraft
Encryption and Key Management StandardCoreDraft
Identification and Authentication StandardCoreDraft
Patch and Flaw Remediation StandardOperateDraft
Remote Access StandardCoreDraft
System Monitoring StandardOperateDraft
Vulnerability Management StandardCoreDraft

Procedures

Section titled “Procedures”
TemplateProgram stageStatus
Account Management ProcedureCoreDraft
Incident Handling PlaybookCoreDraft
Log Review ProcedureCoreDraft

Forms and registers

Section titled “Forms and registers”
TemplateProgram stageStatus
Access AgreementCoreDraft
Access Request FormCoreDraft
Access Review RecordCoreDraft
Change Request FormCoreDraft
Component InventoryCoreDraft
External Service ReviewOperateDraft
Incident Report FormCoreDraft
Information Exchange AgreementOperateDraft
Maintenance LogOperateDraft
Media Sanitization RecordOperateDraft
Onboarding, Transfer and Termination ChecklistCoreDraft
Physical Access ListOperateDraft
Plan of Action and Milestones (POA&M)OperateDraft
Privacy NoticeCoreDraft
Risk RegisterFoundationDraft
Rules of BehaviorFoundationDraft
Security Categorization WorksheetFoundationDraft
Supplier Assessment QuestionnaireMatureDraft
System InventoryFoundationDraft
Training Record LogCoreDraft
Visitor LogOperateDraft

Reports

Section titled “Reports”
TemplateProgram stageStatus
Business Impact AnalysisCoreDraft
Contingency Plan After-Action ReportOperateDraft
Privacy Impact AssessmentCoreDraft
Risk Assessment ReportFoundationDraft
Security and Privacy Assessment ReportOperateDraft

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.