Starter kit

Starter kit template: the minimal set of documents to adopt first when building a program from nothing.

Download one file for your baseline and you have the documents a new program adopts first: the plans and policies the Foundation and Core stages call for, with the decision worksheets that tell you what to fill in. Each document comes ready to adopt and annotated, in Word and Markdown. Template version 1.0.0, based on NIST SP 800-53 Rev. 5, release 5.2.0.

What it contains

Artifact	Main controls	In this version
Information Security Program Plan	PM-1, PM-2, PM-3, PM-6, PM-10, PM-29	Included
Risk Management Strategy	PM-9, PM-28, PM-29, PM-31	Included
Information Security and Privacy Policy	AC-1, AT-1, AU-1, CA-1, CM-1, CP-1, IA-1, IR-1, MA-1, MP-1, PE-1, PL-1, PM-1, PS-1, RA-1, SA-1, SC-1, SI-1, SR-1	Included
System Security Plan	PL-2, RA-2, CM-8, CA-3, CA-5	Included
Rules of Behavior	PL-4, PL-4(1), PE-17	Included
Incident Response Plan	IR-8, IR-8(1), IR-4, IR-5, IR-6, IR-7, IR-2, IR-3	Included
Plan of Action and Milestones (POA&M)	CA-5, CA-7, PM-4	Included
System Inventory	PM-5, PM-5(1)	Included
Decision worksheets for the families in the kit		Included

The kit carries the Information Security and Privacy Policy for your baseline: every family policy in one document. To adopt a policy per family instead, download the family policies from their pages, in the family packs or in the full kit.

Downloads

Baseline	Download
Low	Starter kit, Low (.zip)
Moderate	Starter kit, Moderate (.zip)
High	Starter kit, High (.zip)

Where to start

1. Fill in the decision worksheets with the people who own each decision.
2. Adopt the Information Security and Privacy Policy, carrying the worksheet values into its highlighted fields.
3. Write the System Security Plan for your first system, and start its POA&M.
4. Adopt the Incident Response Plan and test it with a tabletop exercise.