Markdown Editor
Mở trình soạn thảo

Bộ mẫu trưởng nhóm GRC bảo mật

Quản trị, rủi ro và tuân thủ bảo mật: hồ sơ khung, ma trận rủi ro và kiểm soát, ngoại lệ, rà soát quyền truy cập và chỉ số cho HĐQT.

12 mẫu trong 4 bước, theo thứ tự sử dụng. Mở mẫu bất kỳ trong trình soạn thảo, điền nội dung rồi xuất ra PDF, DOCX hoặc HTML.

Bước 1

Định hình bài toán

  1. NIST CSF 2.0 Organizational Profile Template

    Đầy đủ

    CSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary

    NIST CSF 2.0 (CSWP 29, 2024)

  2. Risk Assessment Methodology Template

    Chuẩn

    Risk criteria and score-only bands, acceptance authority, event or asset-based assessment steps, treatment options, outputs, AI-risk variant (ISO/IEC 42001)

    ISO/IEC 27001:2022 + Amd 1:2024 cl. 6.1.2, 6.1.3; ISO/IEC 27005:2022; ISO 31000:2018

  3. Legal and Regulatory Requirements Register Template

    Gọn

    Legal, regulatory and contractual register (ISO/IEC 27001 A.5.31, ISO 14001/45001 6.1.3): dated EU, UK, US example rows, control mapping, change log

    ISO/IEC 27001:2022 A.5.31; ISO 14001:2015 and ISO 45001:2018 6.1.3
Bước 2

Đánh giá tác động

  1. Risk Register Template

    Chuẩn

    Risk register with appetite, inherent and residual scores, Annex A controls, owner acceptance with expiry, inherent and residual heat maps, review log

    ISO/IEC 27001:2022 + Amd 1:2024 cl. 8.2, 8.3; ISO 31000:2018

  2. Risk and Control Matrix Template (SOX ICFR, RCM)

    Đầy đủ

    ICFR risk and control matrix: process index, assertions, control attributes, matrix by process, IPE, SOC 1 CUECs, fraud flags, SoD conflicts, coverage checks

    SOX 404(a); Reg S-K Item 308 / Form 20-F Item 15; SEC Release 33-8810; GAO Green Book 2025

  3. Security Exception Request Template (Risk Acceptance)

    Chuẩn

    Policy exception and risk acceptance form: requirement not met, justification, inherent and residual risk, compensating controls, approver tiers, expiry, lifecycle

    ISO/IEC 27001:2022 cl. 6.1.3, 8.3 (cited only); NIST SP 800-53 Rev. 5 PM-9, RA-7
Bước 3

Vận hành

  1. User Access Review Template (ISO 27001, SOC 2, SOX)

    Đầy đủ

    Audit-grade user access review: population completeness, per-account decisions, privileged and service accounts, SoD, leavers, remediation, ISO/SOC 2/SOX mapping

    ISO/IEC 27001:2022 A.5.18, A.8.2; AICPA TSC 2017 CC6.2, CC6.3; SOX 404 ITGC

  2. Vulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)

    Đầy đủ

    Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

    CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4

  3. Supplier Security Assessment Template

    Chuẩn

    Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

    ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex I

  4. Security Awareness and Training Programme Template (NIST SP 800-50r1)

    Đầy đủ

    Awareness and training plan: drivers, audiences, needs analysis, role-based curriculum, campaigns, phishing simulation rules, metrics, maturity, budget

    NIST SP 800-50 Rev. 1 (Sept 2024); NIST CSF 2.0 PR.AT
Bước 4

Đánh giá Well-Architected

  1. Security Metrics Report Template (NIST SP 800-55, CSF 2.0)

    Đầy đủ

    Security board report: summary, measure catalogue, results by CSF 2.0 Function, trends, risk appetite, incidents, corrective actions, decisions

    NIST SP 800-55 Vol. 1 and 2 (Dec 2024); NIST CSF 2.0

  2. Management Review Minutes Template

    Chuẩn

    Management review minutes: inputs mapped to ISO 9001:2026, ISO/IEC 27001:2022 and 42001:2023, conclusions, results, action log

    ISO 9001:2026, ISO/IEC 27001:2022, ISO/IEC 42001:2023 (cl. 9.3)