Information Security and Privacy Policy

Information Security and Privacy Policy template: Ready-to-adopt consolidated security and privacy policy template for NIST SP 800-53 Rev. 5: every family policy in one document, with a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Information Security and Privacy Policy is every family policy in one document, for an organization that would rather adopt one policy than twenty. It is assembled from the same sources as the family policies, so its statements are theirs word for word. The sections every family policy shares are written once and meet each family’s -1 control, such as AC-1. Each family then has its own part under Policy statements, with the accountable role of its family policy.

Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles. The Program Management part is the same in every variant: SP 800-53B allocates no PM control to a baseline, and the organization carries them out once for all its systems. The Personally Identifiable Information Processing and Transparency family, which NIST places in the Privacy baseline only, is in the Privacy variant only. The Privacy variant has every family’s Privacy-baseline statements: adopt it alongside the security variant wherever systems process personally identifiable information, or move its statements into the matching parts of the security variant so there is one document.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for. For any one scope, adopt either this policy or the family policies, not both. The starter kit carries this policy at your baseline.

Families covered

Each cell counts the controls and enhancements the variant has statements for, the -1 control included; the family policy lists them. A blank cell means the family has no part in that variant.

Family	Low	Moderate	High	Privacy
Access Control (AC)	11	39	46	2
Awareness and Training (AT)	5	6	6	5
Audit and Accountability (AU)	10	16	25	4
Assessment, Authorization, and Monitoring (CA)	8	10	14	6
Configuration Management (CM)	9	24	32	2
Contingency Planning (CP)	6	23	35
Identification and Authentication (IA)	16	24	26
Incident Response (IR)	7	13	18	10
Maintenance (MA)	4	9	12
Media Protection (MP)	4	7	10	2
Physical and Environmental Protection (PE)	10	18	25	2
Planning (PL)	6	7	7	6
Program Management (PM)	37	37	37	37
Personnel Security (PS)	9	9	10	2
Personally Identifiable Information Processing and Transparency (PT)				13
Risk Assessment (RA)	8	10	11	4
System and Services Acquisition (SA)	9	17	21	7
System and Communications Protection (SC)	10	25	30	2
System and Information Integrity (SI)	6	18	28	8
Supply Chain Risk Management (SR)	11	12	14

Decisions to make first

The shared sections take one set of -1 values for every family: who receives the policy and the procedures, the managing official, and how often and after which events each is reviewed. Every other field is a family’s own parameter. Record your values in the decision worksheets, one per family, and give each family’s -1 rows the values you choose for the shared sections.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

The family policies stay available on their own pages, in each family pack and in the full kit.

Preview (Moderate baseline, annotated)

Each family’s part is summarized here, with a link to its family policy; the downloads have the full text.

Guidance

This policy brings every family policy into one document, as an alternative to adopting a policy per family. It is assembled from the same sources. The sections every family policy shares are written once, and each family’s statements are in its own part under Policy statements. Each family’s -1 control asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle; the shared sections meet those elements for every family listed under Control families. Assessors check each element for each family, so keep every shared section even when it is short. For any one scope, adopt either this policy or the family policies, not both, so each requirement has one source.

Purpose

This policy states what Organization name requires for Information Security and Privacy, and who is accountable for meeting those requirements. (XX-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (XX-1a.1(a))

Control families

This policy is the policy of each control family below, in place of separate family policies. Its shared sections meet the first control of each family, the -1 control, which asks for a policy and procedures; a reference such as (XX-1a.1(a)) cites that item of the -1 control of every family below. PM-1 asks for different elements, so the Program Management part opens with its own statements for it. Each family’s statements are in its own part under Policy statements.

Family	Policy control	Accountable role
Access Control (AC)	AC-1	Chief Information Security Officer
Awareness and Training (AT)	AT-1	Chief Information Security Officer
Audit and Accountability (AU)	AU-1	Chief Information Security Officer
Assessment, Authorization, and Monitoring (CA)	CA-1	Chief Information Security Officer
Configuration Management (CM)	CM-1	Chief Information Security Officer
Contingency Planning (CP)	CP-1	Chief Information Security Officer
Identification and Authentication (IA)	IA-1	Chief Information Security Officer
Incident Response (IR)	IR-1	Chief Information Security Officer
Maintenance (MA)	MA-1	Chief Information Security Officer
Media Protection (MP)	MP-1	Chief Information Security Officer
Physical and Environmental Protection (PE)	PE-1	Facilities manager
Planning (PL)	PL-1	Chief Information Security Officer
Program Management (PM)	PM-1	Chief Information Security Officer
Personnel Security (PS)	PS-1	Chief Information Security Officer
Risk Assessment (RA)	RA-1	Chief Information Security Officer
System and Services Acquisition (SA)	SA-1	Chief Information Security Officer
System and Communications Protection (SC)	SC-1	Chief Information Security Officer
System and Information Integrity (SI)	SI-1	Chief Information Security Officer
Supply Chain Risk Management (SR)	SR-1	Chief Information Security Officer

• Where the table names a role other than the Chief Information Security Officer for a family, that role shall be accountable for the family’s part of this policy and shall approve exceptions to it, in coordination with the Chief Information Security Officer. (XX-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (XX-1a.1(a))
• The Fill in: an official to manage the information security and privacy policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (XX-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (XX-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (XX-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (XX-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (XX-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (XX-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (XX-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (XX-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (XX-1a.1(a))

Procedures

The Fill in: an official to manage the information security and privacy policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (XX-1a.2)

Dissemination

• The Fill in: an official to manage the information security and privacy policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the information security and privacy policy is to be disseminated Typical: everyone within its scope, through the policy library. (XX-1a)
• The Fill in: an official to manage the information security and privacy policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the information security and privacy procedures are to be disseminated Typical: the people who carry them out, and the system owners. (XX-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Access Control (AC)

The statements of the Access Control Policy, Moderate variant: 38 controls and enhancements.

Awareness and Training (AT)

The statements of the Awareness and Training Policy, Moderate variant: 5 controls and enhancements.

Audit and Accountability (AU)

The statements of the Audit and Accountability Policy, Moderate variant: 15 controls and enhancements.

Assessment, Authorization, and Monitoring (CA)

The statements of the Assessment, Authorization, and Monitoring Policy, Moderate variant: 9 controls and enhancements.

Configuration Management (CM)

The statements of the Configuration Management Policy, Moderate variant: 23 controls and enhancements.

Contingency Planning (CP)

The statements of the Contingency Planning Policy, Moderate variant: 22 controls and enhancements.

Identification and Authentication (IA)

The statements of the Identification and Authentication Policy, Moderate variant: 23 controls and enhancements.

Incident Response (IR)

The statements of the Incident Response Policy, Moderate variant: 12 controls and enhancements.

Maintenance (MA)

The statements of the Maintenance Policy, Moderate variant: 8 controls and enhancements.

Media Protection (MP)

The statements of the Media Protection Policy, Moderate variant: 6 controls and enhancements.

Physical and Environmental Protection (PE)

The statements of the Physical and Environmental Protection Policy, Moderate variant: 17 controls and enhancements.

Planning (PL)

The statements of the Planning Policy, Moderate variant: 6 controls and enhancements.

Program Management (PM)

Opens with its own PM-1 statements, then has the statements of the Program Management Policy, organization-wide edition: 36 controls and enhancements.

Personnel Security (PS)

The statements of the Personnel Security Policy, Moderate variant: 8 controls and enhancements.

Risk Assessment (RA)

The statements of the Risk Assessment Policy, Moderate variant: 9 controls and enhancements.

System and Services Acquisition (SA)

The statements of the System and Services Acquisition Policy, Moderate variant: 16 controls and enhancements.

System and Communications Protection (SC)

The statements of the System and Communications Protection Policy, Moderate variant: 24 controls and enhancements.

System and Information Integrity (SI)

The statements of the System and Information Integrity Policy, Moderate variant: 17 controls and enhancements.

Supply Chain Risk Management (SR)

The statements of the Supply Chain Risk Management Policy, Moderate variant: 11 controls and enhancements.

Review and update

• The Fill in: an official to manage the information security and privacy policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current information security and privacy policy is reviewed and updated Typical: annually and following Fill in: events that would require the current information security and privacy policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (XX-1c.1)
• The Fill in: an official to manage the information security and privacy policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current information security and privacy procedures are reviewed and updated Typical: annually and following Fill in: events that would require procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (XX-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (XX-1a.1(b))