[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-354511-105":53,"doc-detail-354511-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","nist-cybersecurity-framework-policy-template-guide","NIST Cybersecurity Framework Policy Template Guide","","A policy template guide for MS-ISAC participants that maps the NIST Cybersecurity Framework (NIST CSF) to practical policy and standard templates. It correlates multiple NIST subcategories (e.g., ID.AM, ID.SC, PR.AC, PR.DS, DE.AE, RS.RP, RS.CO, RS.AN, RS.IM, RC.RP, RC.IM, RC.CO) with suggested template documents for customizing organizational cybersecurity policy baselines. Includes an introduction, a disclaimer about NIST revision coverage, and additional template groupings such as network, server security, and application security.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":46,"@type":70,"position":76},"https://docshare.wps.com/template/paper-templates/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/nist-cybersecurity-framework-policy-template-guide/354511/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/nist-cybersecurity-framework-policy-template-guide/354511.png","ImageObject",442,249,{"name":88,"@type":89},"Guten tag","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-17","2026-09-22",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",7,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What is the purpose of the Policy Template Guide for MS-ISAC participants?","Question",{"text":109,"@type":110},"It provides a resource to help participants apply and advance cybersecurity policies by correlating NIST CSF subcategories with applicable policy and standard templates.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How does the guide represent a NIST CSF subcategory?",{"text":114,"@type":110},"Each NIST subcategory is represented by text such as “ID.AM-5,” where the prefix indicates the NIST function and the category indicates the subcategory area.",{"name":116,"@type":107,"acceptedAnswer":117},"Are the provided policy templates intended to match the most recent NIST revision?",{"text":118,"@type":110},"The guide includes a disclaimer stating these policies may not reference the most recent applicable NIST revision, but they can be used as a baseline template.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},354511,1791378952,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":45,"category_name":46,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":35,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},687212321768,"https://ap-avatar.wpscdn.com/avatar/a0010bdbe886d2fe77?x-image-process=image/resize,m_fixed,w_180,h_180&k=1789897067658708522","cisecurity isac/  \nNIST Cybersecurity Framework  \nPolicy Template Guide  \nContents  Introduction 1  \nNIST Function: Identify 2  \nIdentify: Asset Management (ID.AM) 2  \nIdentify: Supply Chain Risk Management (ID.SC) 3  \nNIST Function: Protect 4  \nProtect: Identity Management and Access Control (PR.AC) 4  \nProtect: Data Security (PR. DS) 5  \nProtect: Information Protection Processes and Procedures (PR. IP) 6  \nProtect: Maintenance (PR. MA) 7  \nProtect: Protective Technology (PR. PT) 7  \nNIST Function: Detect 9  \nDetect: Anomalies and Events (DE. AE) 9  \nDetect: Security Continuous Monitoring (DE.CM) 9  \nNIST Function: Respond 11  \nRespond: Response Planning (RS. RP)6 11  \nRespond: Communications (RS.CO) 11  \nRespond: Analysis (RS.AN) 12  \nRespond: Improvements (RS.IM) 12  \nNIST Function: Recover 13  \nRecover: Recovery Planning (RC. RP) 13  \nRecover: Improvements (RC.IM) 13  \nRecover: Communications (RC. CO) 13  \nAdditional Policy Templates 15  \nGeneral 15  \nNetwork 15  \nServer Security 15  \nApplication Security 15  \nIntroduction  \nThe Multi-State Information Sharing & Analysis Center (MS-ISAC) is offering this guide to participants of the Nationwide Cybersecurity Review (NCSR) and MS-ISAC members, as aresource to assist with the application and advancement of cybersecurity policies.  \nThe policy templates are provided courtesy of the SANS Institute ( [https://www](https://www). [sans.org/](sans.org/)), the State of New York, and the State of California. The templates can be customized and used as an outline of an organizational policy, with additional details tobe added by the end user.  \nThe NCSR question set represents the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) . This guide gives the correlation between 49 of the NIST CSF subcategories, and applicable policy and standard templates. A NIST subcategory is represented by text, such as “ID.AM-5.” This represents the NIST function of Identify and the category of Asset Management.  \nFor additional information on services provided by the Multi-State Information Sharing & Analysis Center (MS-ISAC), please refer to the following page: [https://www.cisecurity](https://www.cisecurity). org/ms-isac/services/. These policy templates are also mapped to the resources MS-ISAC and CIS provide, open source resources, and free FedVTE training: [https://www.cisecurity](https://www.cisecurity). org/wp-content/uploads/2019/11/Cybersecurity-Resources-Guide.pdf.  \nDisclaimer: These policies may not reference the most recent applicable NIST revision, however may be used as a baseline template for end users.  \nNIST FUNCTION:  \nIdentify  \nIdentify: Asset Management (ID.AM)  \nID.AM-1 Physical devices and systems within the organization are inventoried.  \n↗Acceptable Use of Information Technology Resource Policy  \nAccess Control Policy  \nAccount Management/Access Control Standard  \nIdentification and Authentication Policy  \nInformation Security Policy  \nSecurity Assessment and Authorization Policy  \nSecurity Awareness and Training Policy  \nID.AM-2 Software platforms and applications within the organization are inventoried.  \nAcceptable Use of Information Technology Resource Policy  \nAccess Control Policy  \nAccount Management/Access Control Standard  \nIdentification and Authentication Policy  \nInformation Security Policy  \nSecurity Assessment and Authorization Policy  \nSecurity Awareness and Training Policy  \nID.AM-4 External information systems are catalogued.  \nSystem and Communications Protection Policy  \nID.AM-5 Resources (e.g., hardware, devices, data, time, and software) are prioritized based  \non their classification, criticality, and business value).  \nSANS Policy Template: Acquisition Assessment Policy  \nInformation Classification Standard  \nInformation Security Policy  \nID.AM-6 Cybersecurity roles and responsibilities for the entire workforces and third-party stakeholders (e.g. suppliers, customers, partners) are established.  \nAcceptable Use of Informat","cbCaigemyzhb3Cp9","https://ap.wps.com/l/cbCaigemyzhb3Cp9","pdf",645948,"English","# Introduction\n## NIST Function: Identify\n## Identify: Asset Management (ID.AM)\n## Identify: Supply Chain Risk Management (ID.SC)\n## NIST Function: Protect\n## Protect: Identity Management and Access Control (PR.AC)\n## Protect: Data Security (PR.DS)\n## NIST Function: Detect\n## Detect: Anomalies and Events (DE.AE)\n## NIST Function: Respond\n## Respond: Response Planning (RS.RP)\n## Respond: Communications (RS.CO)\n## Respond: Analysis (RS.AN)\n## Respond: Improvements (RS.IM)\n## NIST Function: Recover\n## Recover: Recovery Planning (RC.RP)\n## Recover: Improvements (RC.IM)\n## Additional Policy Templates","[{\"question\":\"What is the purpose of the Policy Template Guide for MS-ISAC participants?\",\"answer\":\"It provides a resource to help participants apply and advance cybersecurity policies by correlating NIST CSF subcategories with applicable policy and standard templates.\"},{\"question\":\"How does the guide represent a NIST CSF subcategory?\",\"answer\":\"Each NIST subcategory is represented by text such as “ID.AM-5,” where the prefix indicates the NIST function and the category indicates the subcategory area.\"},{\"question\":\"Are the provided policy templates intended to match the most recent NIST revision?\",\"answer\":\"The guide includes a disclaimer stating these policies may not reference the most recent applicable NIST revision, but they can be used as a baseline template.\"}]","NIST Cybersecurity Framework Policy Template Guide | PDF",1790111526,6]