IT resource usage rules for all employees, contractors, and third parties.

How to identify, handle, store, transmit, and dispose of Controlled Unclassified Information.

5 role-based attestation documents: Security Officer, IT Director, Systems Admin, IRM, MSP.

Third-party security questionnaire with scoring, risk rating, and approval workflow.

Full system description, boundary, all 110 control statuses with notes. Auto-populated from NIST tool.

All Not Met and Partial controls with gap descriptions, owners, and target dates. Auto-populated from NIST tool.

Full Thomas Andersen format: §1 Intro, §2 Policies, §3 Technical + Appendices A–F (Attestation, Maintenance SOP, Chain of Custody, IRP, GenAI Policy, Signature Page).

Full Thomas Andersen format: Purpose, Scope, Definitions table, AI Advisory Board, GenAI Ownership, Proposals process, Data Management, Acceptable Use table, Transparency, Third-Party Risk, Compliance.

IRT roles from contacts, lifecycle phases, DoD 72-hour notification, 5 incident playbooks, tabletop requirement.

BIA with RTO/RPO table, Recovery Team contacts, 5 disaster scenarios with phased response, backup schedule, remote work procedures, communication plan, DR test log, and signature page.

8-section Security Officer checklist covering governance, vulnerability, training, access, patching, audit, physical, and vendor.