Manage · Management Operations
Policy areas
Policy areas organized with reference to CJIS and NIST SP 800-53 Rev. 5, with additional NIST guidance for cloud services, operational technology and AI.
- Access Control
- Awareness and Training
- Audit and Accountability
- Assessment, Authorization and Monitoring
- Configuration Management
- Contingency Planning
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Physical and Environmental Protection
- Planning
- Program Management
- Personnel Security
- Personally Identifiable Information Processing and Transparency
- Risk Assessment
- System and Services Acquisition
- System and Communications Protection
- System and Information Integrity
- Supply Chain Risk Management
- Information Exchange Agreements
- Mobile Devices
- Operational Technology Security
- Security and Privacy in Public Cloud Computing
- AI Risk Management
NIST SP 800-53 Rev. 5 · CJIS Security Policy · NIST SP 800-82 Rev. 3 · NIST SP 800-144 · NIST AI RMF
An example of a usable policy
Illustrative policy summary
An acceptable-use policy should help people understand the work they may do, the information they may handle and where to bring a question. This public example shows the structure; an organization's approved policy reflects its own people, systems and requirements.
| Part | What it should explain |
|---|---|
| Purpose and owner | The work and people covered, the policy owner and the authority that approves it. |
| Responsibilities | What staff, management, RDA and other providers are each expected to do. |
| Questions and exceptions | Where a real operational need goes for review and an authorized decision. |
| Evidence and review | The approved version, communication or training record, review date and changes that prompt another review. |
The same connection applies to access, devices, information handling, retention and incident reporting. The policy needs related training and practical examples, as well as a way to check the work.
Keep policies connected to the work
Assign an owner and an approver. Connect the policy to the requirements that apply, the people who carry it out and the records that show what happened. Review it when responsibilities, systems, requirements or working conditions change, as well as at the agreed review date.
Controlled document workflows keep drafts, approvals and published versions connected. Reminders and assigned review work help keep an overdue item visible. An authorized person still decides whether the policy is suitable and approves a change.
Public examples describe the approach. Complete policies, organization-specific procedures and working records belong in the approved member area. A listed policy area does not establish that every organization has adopted or implemented the same program.