Markdown Editor
打开编辑器

安全 GRC 负责人套件

开展安全治理、风险与合规：框架配置、风险与控制矩阵、例外、访问审查与董事会指标。

12 个模板，按使用顺序分为 4 步。在编辑器中打开任一模板，填写后可导出为 PDF、DOCX 或 HTML。

第 1 步

问题定义

  1. NIST CSF 2.0 Organizational Profile Template

    完整

    CSF 2.0 profile workbook: scope, Tiers, all 106 Subcategories with Current/Target/gap, SP 800-53 refs, gap summary, action plan, exec summary

    NIST CSF 2.0 (CSWP 29, 2024)

  2. Risk Assessment Methodology Template

    标准

    Risk criteria and score-only bands, acceptance authority, event or asset-based assessment steps, treatment options, outputs, AI-risk variant (ISO/IEC 42001)

    ISO/IEC 27001:2022 + Amd 1:2024 cl. 6.1.2, 6.1.3; ISO/IEC 27005:2022; ISO 31000:2018

  3. Legal and Regulatory Requirements Register Template

    精简

    Legal, regulatory and contractual register (ISO/IEC 27001 A.5.31, ISO 14001/45001 6.1.3): dated EU, UK, US example rows, control mapping, change log

    ISO/IEC 27001:2022 A.5.31; ISO 14001:2015 and ISO 45001:2018 6.1.3
第 2 步

评估

  1. Risk Register Template

    标准

    Risk register with appetite, inherent and residual scores, Annex A controls, owner acceptance with expiry, inherent and residual heat maps, review log

    ISO/IEC 27001:2022 + Amd 1:2024 cl. 8.2, 8.3; ISO 31000:2018

  2. Risk and Control Matrix Template (SOX ICFR, RCM)

    完整

    ICFR risk and control matrix: process index, assertions, control attributes, matrix by process, IPE, SOC 1 CUECs, fraud flags, SoD conflicts, coverage checks

    SOX 404(a); Reg S-K Item 308 / Form 20-F Item 15; SEC Release 33-8810; GAO Green Book 2025

  3. Security Exception Request Template (Risk Acceptance)

    标准

    Policy exception and risk acceptance form: requirement not met, justification, inherent and residual risk, compensating controls, approver tiers, expiry, lifecycle

    ISO/IEC 27001:2022 cl. 6.1.3, 8.3 (cited only); NIST SP 800-53 Rev. 5 PM-9, RA-7
第 3 步

运维

  1. User Access Review Template (ISO 27001, SOC 2, SOX)

    完整

    Audit-grade user access review: population completeness, per-account decisions, privileged and service accounts, SoD, leavers, remediation, ISO/SOC 2/SOX mapping

    ISO/IEC 27001:2022 A.5.18, A.8.2; AICPA TSC 2017 CC6.2, CC6.3; SOX 404 ITGC

  2. Vulnerability Management Policy Template (CVSS 4.0, EPSS, KEV, SSVC)

    完整

    Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

    CVSS v4.0; EPSS; CISA KEV; CISA SSVC guide; CISA BOD 26-04; NIST SP 800-40 Rev. 4

  3. Supplier Security Assessment Template

    标准

    Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

    ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex I

  4. Security Awareness and Training Programme Template (NIST SP 800-50r1)

    完整

    Awareness and training plan: drivers, audiences, needs analysis, role-based curriculum, campaigns, phishing simulation rules, metrics, maturity, budget

    NIST SP 800-50 Rev. 1 (Sept 2024); NIST CSF 2.0 PR.AT
第 4 步

Well-Architected 评审

  1. Security Metrics Report Template (NIST SP 800-55, CSF 2.0)

    完整

    Security board report: summary, measure catalogue, results by CSF 2.0 Function, trends, risk appetite, incidents, corrective actions, decisions

    NIST SP 800-55 Vol. 1 and 2 (Dec 2024); NIST CSF 2.0

  2. Management Review Minutes Template

    标准

    Management review minutes: inputs mapped to ISO 9001:2026, ISO/IEC 27001:2022 and 42001:2023, conclusions, results, action log

    ISO 9001:2026, ISO/IEC 27001:2022, ISO/IEC 42001:2023 (cl. 9.3)