A curated list of ComplianceForge cybersecurity documentation templates and Secure Controls Framework (SCF) resources for policies, standards, procedures, and compliance mapping (NIST 800-171, CMMC, ISO 27001, PCI DSS, and more).
- Why This List Exists
- Policies and Standards Templates
- Procedures Templates
- Bundled Solutions
- NIST 800-171 and CMMC Compliance
- Risk Management and Incident Response
- PCI DSS Compliance
- Secure Controls Framework (SCF) Free Content
- SCF Certifications and Community
- Free Guides
- About ComplianceForge
ComplianceForge has published editable, professionally written cybersecurity and data privacy documentation since 2005. This list organizes ComplianceForge's product catalog alongside free resources from the Secure Controls Framework (SCF), the metaframework several ComplianceForge products are built on. ComplianceForge is a SCF Licensed Content Provider (LCP).
| Product | Description |
|---|---|
| Policies and Standards - SCF (SCRP) | Security, Compliance and Resilience Program (SCRP), SCF-based policies and standards |
| Policies and Standards - NIST CSF 2.0 | Policies and standards aligned to NIST Cybersecurity Framework 2.0 |
| Policies and Standards - ISO 27001/27002 | Policies and standards aligned to ISO 27001/27002 |
| Policies and Standards - NIST 800-53 R5 (Moderate) | Policies and standards for the NIST 800-53 Rev 5 moderate baseline |
| Policies and Standards - NIST 800-53 R5 (High) | Policies and standards for the NIST 800-53 Rev 5 high baseline |
| Policies and Standards - CORE Fundamentals | Baseline policies and standards for smaller organizations |
| Product | Description |
|---|---|
| Procedures - SCF (CSOP) | Cybersecurity Standardized Operating Procedures (CSOP), SCF-aligned procedures |
| Procedures - NIST CSF 2.0 | Procedures aligned to NIST CSF 2.0 |
| Procedures - ISO 27001/27002 | Procedures aligned to ISO 27001/27002 |
| Procedures - NIST 800-53 R5 (Moderate) | Procedures for the NIST 800-53 Rev 5 moderate baseline |
| Procedures - NIST 800-53 R5 (High) | Procedures for the NIST 800-53 Rev 5 high baseline |
| Procedures - CORE Fundamentals | Baseline procedures for smaller organizations |
| Bundle | Description |
|---|---|
| NIST 800-171 and CMMC Compliance Bundles | CMMC Bundles 1-4, covering CMMC 2.0 Levels 1-3 |
| Policies, Standards and Procedures (PSP) Bundles | Combined PSP bundles for NIST CSF 2.0, ISO 27001/27002, NIST 800-53 (Moderate/High), and CORE Fundamentals |
| Compliance-Focused Documentation (CFD) Bundles | Program-level documentation bundles for NIST CSF 2.0, ISO 27001/27002, and NIST 800-53 (Moderate/High) |
| Premium GRC Content (SCF Bundles) | SCF Bundle 1 (policies, standards, procedures, and metrics) and SCF Bundle 2 (robust documentation solution) |
| Resource | Description |
|---|---|
| NIST 800-171 Compliance Program (NCP) | Bundle covering policies, standards, procedures, SSP, and POA&M templates for NIST 800-171 / CMMC Level 2 |
| NIST 800-171 System Security Plan (SSP) Template | Editable System Security Plan template |
| NIST 800-171 R3 Transition Guide | Free guide for migrating from NIST 800-171 R2 to R3 |
| CMMC Kill Chain - A Prioritized Approach | Free guide prioritizing which controls to implement first |
| Resource | Description |
|---|---|
| Supply Chain Risk Management (SCRM) Plan Template | SCRM plan template |
| C-SCRM Strategy and Implementation Plan (C-SCRM SIP) | Based on NIST SP 800-161 Rev 1 |
| Risk Management Program (RMP) | Formal risk management documentation |
| Cybersecurity Risk Assessment (CRA) Template | Risk assessment template |
| Third-Party Risk Management (TPRM) Program | Third-party / vendor risk management documentation |
| Physical Security Plan (PSP) | Physical security planning documentation |
| Integrated Incident Response Program (IIRP) | Incident response program documentation |
| Continuity of Operations Program (COOP) | Business continuity documentation |
| Resource | Description |
|---|---|
| Policies and Standards - PCI DSS v4 SAQ A | For SAQ A merchants |
| Policies and Standards - PCI DSS v4 SAQ A-EP | For SAQ A-EP merchants |
| Policies and Standards - PCI DSS v4 SAQ B | For SAQ B merchants |
| Policies and Standards - PCI DSS v4 SAQ C | For SAQ C merchants |
| Policies and Standards - PCI DSS v4 SAQ D (Merchant) | For SAQ D merchants |
| Policies and Standards - PCI DSS v4 SAQ D (Service Provider) | For SAQ D service providers |
| Resource | Description |
|---|---|
| Download the SCF | Full control catalog, free, in CSV/Excel or NIST OSCAL JSON |
| Risk Management Model (SCR-RMM) | Free SCF risk management model |
| Capability Maturity Model (SCR-CMM) | Free SCF capability maturity model |
| Cybersecurity Assessment Standards (CDPAS) | Free assessment standards |
| Evidence Request List (ERL) | Free evidence request list |
| Unified Scoping Guide (USG) | Free scoping guide |
| Data Privacy Management Principles (DPMP) | Free privacy principles |
| Mergers, Acquisitions and Divestitures (MA&D) | Free M&A guidance |
| Resource | Description |
|---|---|
| SCF Conformity Assessment Program (CAP) | Organization-level SCF certification program |
| SCF Practitioner / Architect / Assessor Training | Individual-level SCF training and certification |
| SCF Licensed Content Providers (LCPs) | Vendors, including ComplianceForge, authorized to sell SCF-based documentation |
| SCF Marketplace | Directory of SCF-aligned providers and integrators |
| Resource | Description |
|---|---|
| NIST 800-53 vs ISO 27002 vs NIST CSF vs SCF | Framework comparison guide |
| Policies vs Standards vs Controls vs Procedures | Terminology guide |
| Hierarchical Cybersecurity Governance Framework (HCGF) | Documentation hierarchy model |
| What Is the SCF? | Introduction to the Secure Controls Framework |
| SCRMS - How to Implement the SCF | Implementation guide for the SCF |
Add links, correct pricing or descriptions, or suggest new resources by opening an issue or pull request.
ComplianceForge, LLC is a Veteran-Owned Small Business (VOSB) that has written editable cybersecurity and data privacy documentation since 2005, and is a SCF Licensed Content Provider (LCP).
- Website: https://complianceforge.com
- Products: https://complianceforge.com/cybersecurity-templates
- Documentation Examples: https://complianceforge.com/examples
- FAQ: https://complianceforge.com/faq
- Contact Us: https://complianceforge.com/contact-us
- Secure Controls Framework: https://securecontrolsframework.com
30 N Gould St, Suite 9141, Sheridan, WY 82801 - +1-307-241-8740