Information Security Policy and Procedures Writing for Regulatory Compliance

Stop and think about the many initiatives, legislative mandates, and supporting business directives currently in place (i.e., ISO 27001 | 27002, FISMA, HIPAA, GLBA, FFIEC, PCI DSS, SOC 1, SOC 2 AT 101, GDPR, CCPA, etc.) and it can be overwhelming indeed. The vast majority of these regulatory compliance programs mandate that organizations have documented information security policies and procedures in place. But easier said than done, as authoring these documents can be tedious, arduous, time-consuming, and most-of-all, challenging.

Years of Experience in Writing Security Policies and Procedures

At Centris, we have a deep bench of experienced, capable, and professional consultants who specialize in developing well-written, highly customized policy and procedure documents for organizations all across North America and Europe. What's more, our policy and procedure templates include documentation for all applicable information security categories and domains. 

We also have years of expertise working with a wide-range of regulatory compliance programs, such as NIST RMF, FISMA, FBI CJIS, FedRAMP, eMASS/NISP, NIST 800-171, and CMMC. 

InfoSec Templates for Writing InfoSec Policies

Moreover, our policy and procedure documents are extremely in-depth and comprehensive, as they include the following:

• Hundreds of policies and procedures, forms, checklists, templates, and provisioning and hardening documents - all relating to information security.
• Dozens and dozens of sections and categories, including many business and operational policy and procedure documents vital to information systems, such as Risk Assessment, Security Awareness Training, Incident Response, etc.
• Material developed exclusively for many of today's emerging information technology sectors, such as virtualization and cloud computing.

What Makes our Documentation Different?

Additionally, our consultants possess a strong working knowledge of all the following frameworks and other sources when it comes to developing security policies and procedures for our valued clients:

• AICPA SOC
• PCI DSS
• FISMA, CMMC, DFARS, FedRAMP
• ISO 27001 | 27002 framework
• Information Technology Infrastructure Library (ITIL)
• COBIT | Control Objectives for Information and Related Technologies
• COSO | Committee of Sponsoring Organizations of the Treadway Commission
• NIST SP 800 Publications (Approximately 100 + publications)
• Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) | Unclassified Documents
• United States Computer Emergency Readiness Team (US CERT)
• CIS Security Benchmarks Division
• NIST National Vulnerability Database
• Open-Source Vulnerability Database
• Common Configuration Enumeration (CCG)
• Common Vulnerabilities and Exposures CVE
• Cloud Security Alliance (CSA)
• SANS Institute
• Open Web Application Security Project (OWASP)
• Vendor specific setup, configuration and hardening guides for all major network devices, operating system, databases, web servers, and more.