Kit Security-GRC-Lead
Sicherheits-Governance, Risiko und Compliance steuern: Framework-Profil, Risiko-Kontroll-Matrix, Ausnahmen, Zugriffsreviews und Kennzahlen für die Leitung.
12 Vorlagen in 4 Schritten, in der Reihenfolge der Nutzung. Öffnen Sie eine Vorlage im Editor, füllen Sie sie aus und exportieren Sie sie als PDF, DOCX oder HTML.
Problemdefinition
NIST CSF 2.0 Organizational Profile Template
VollständigCSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary
NIST CSF 2.0 (CSWP 29, 2024)Risk Assessment Methodology Template
StandardRisk criteria and score-only bands, acceptance authority, event or asset-based assessment steps, treatment options, outputs, AI-risk variant (ISO/IEC 42001)
ISO/IEC 27001:2022 + Amd 1:2024 cl. 6.1.2, 6.1.3; ISO/IEC 27005:2022; ISO 31000:2018Legal and Regulatory Requirements Register Template
KompaktLegal, regulatory and contractual register (ISO/IEC 27001 A.5.31, ISO 14001/45001 6.1.3): dated EU, UK, US example rows, control mapping, change log
ISO/IEC 27001:2022 A.5.31; ISO 14001:2015 and ISO 45001:2018 6.1.3
Bewertungen
Risk Register Template
StandardRisk register with appetite, inherent and residual scores, Annex A controls, owner acceptance with expiry, inherent and residual heat maps, review log
ISO/IEC 27001:2022 + Amd 1:2024 cl. 8.2, 8.3; ISO 31000:2018Risk and Control Matrix Template (SOX ICFR, RCM)
VollständigICFR risk and control matrix: process index, assertions, control attributes, matrix by process, IPE, SOC 1 CUECs, fraud flags, SoD conflicts, coverage checks
SOX 404(a); Reg S-K Item 308 / Form 20-F Item 15; SEC Release 33-8810; GAO Green Book 2025Security Exception Request Template (Risk Acceptance)
StandardPolicy exception and risk acceptance form: requirement not met, justification, inherent and residual risk, compensating controls, approver tiers, expiry, lifecycle
ISO/IEC 27001:2022 cl. 6.1.3, 8.3 (cited only); NIST SP 800-53 Rev. 5 PM-9, RA-7
Betrieb
User Access Review Template (ISO 27001, SOC 2, SOX)
VollständigAudit-grade user access review: population completeness, per-account decisions, privileged and service accounts, SoD, leavers, remediation, ISO/SOC 2/SOX mapping
ISO/IEC 27001:2022 A.5.18, A.8.2; AICPA TSC 2017 CC6.2, CC6.3; SOX 404 ITGCVulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)
VollständigEnterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics
CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4Supplier Security Assessment Template
StandardSupplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision
ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex ISecurity Awareness and Training Programme Template (NIST SP 800-50r1)
VollständigAwareness and training plan: drivers, audiences, needs analysis, role-based curriculum, campaigns, phishing simulation rules, metrics, maturity, budget
NIST SP 800-50 Rev. 1 (Sept 2024); NIST CSF 2.0 PR.AT
Well-Architected-Review
Security Metrics Report Template (NIST SP 800-55, CSF 2.0)
VollständigSecurity board report: summary, measure catalogue, results by CSF 2.0 Function, trends, risk appetite, incidents, corrective actions, decisions
NIST SP 800-55 Vol. 1 and 2 (Dec 2024); NIST CSF 2.0Management Review Minutes Template
StandardManagement review minutes: inputs mapped to ISO 9001:2026, ISO/IEC 27001:2022 and 42001:2023, conclusions, results, action log
ISO 9001:2026, ISO/IEC 27001:2022, ISO/IEC 42001:2023 (cl. 9.3)