Kit de responsable de GRC de seguridad
Gobierno, riesgo y cumplimiento de seguridad: perfil de marco, matriz de riesgos y controles, excepciones, revisiones de acceso y métricas para el consejo.
12 plantillas en 4 pasos, en el orden en que se usan. Abre cualquier plantilla en el editor, complétala y expórtala a PDF, DOCX o HTML.
Planteamiento
NIST CSF 2.0 Organizational Profile Template
CompletaCSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary
NIST CSF 2.0 (CSWP 29, 2024)Risk Assessment Methodology Template
EstándarRisk criteria and score-only bands, acceptance authority, event or asset-based assessment steps, treatment options, outputs, AI-risk variant (ISO/IEC 42001)
ISO/IEC 27001:2022 + Amd 1:2024 cl. 6.1.2, 6.1.3; ISO/IEC 27005:2022; ISO 31000:2018Legal and Regulatory Requirements Register Template
BreveLegal, regulatory and contractual register (ISO/IEC 27001 A.5.31, ISO 14001/45001 6.1.3): dated EU, UK, US example rows, control mapping, change log
ISO/IEC 27001:2022 A.5.31; ISO 14001:2015 and ISO 45001:2018 6.1.3
Evaluaciones
Risk Register Template
EstándarRisk register with appetite, inherent and residual scores, Annex A controls, owner acceptance with expiry, inherent and residual heat maps, review log
ISO/IEC 27001:2022 + Amd 1:2024 cl. 8.2, 8.3; ISO 31000:2018Risk and Control Matrix Template (SOX ICFR, RCM)
CompletaICFR risk and control matrix: process index, assertions, control attributes, matrix by process, IPE, SOC 1 CUECs, fraud flags, SoD conflicts, coverage checks
SOX 404(a); Reg S-K Item 308 / Form 20-F Item 15; SEC Release 33-8810; GAO Green Book 2025Security Exception Request Template (Risk Acceptance)
EstándarPolicy exception and risk acceptance form: requirement not met, justification, inherent and residual risk, compensating controls, approver tiers, expiry, lifecycle
ISO/IEC 27001:2022 cl. 6.1.3, 8.3 (cited only); NIST SP 800-53 Rev. 5 PM-9, RA-7
Operación
User Access Review Template (ISO 27001, SOC 2, SOX)
CompletaAudit-grade user access review: population completeness, per-account decisions, privileged and service accounts, SoD, leavers, remediation, ISO/SOC 2/SOX mapping
ISO/IEC 27001:2022 A.5.18, A.8.2; AICPA TSC 2017 CC6.2, CC6.3; SOX 404 ITGCVulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)
CompletaEnterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics
CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4Supplier Security Assessment Template
EstándarSupplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision
ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex ISecurity Awareness and Training Programme Template (NIST SP 800-50r1)
CompletaAwareness and training plan: drivers, audiences, needs analysis, role-based curriculum, campaigns, phishing simulation rules, metrics, maturity, budget
NIST SP 800-50 Rev. 1 (Sept 2024); NIST CSF 2.0 PR.AT
Revisión Well-Architected
Security Metrics Report Template (NIST SP 800-55, CSF 2.0)
CompletaSecurity board report: summary, measure catalogue, results by CSF 2.0 Function, trends, risk appetite, incidents, corrective actions, decisions
NIST SP 800-55 Vol. 1 and 2 (Dec 2024); NIST CSF 2.0Management Review Minutes Template
EstándarManagement review minutes: inputs mapped to ISO 9001:2026, ISO/IEC 27001:2022 and 42001:2023, conclusions, results, action log
ISO 9001:2026, ISO/IEC 27001:2022, ISO/IEC 42001:2023 (cl. 9.3)