Elliott Harnagel

CMMC Policy Templates

CMMC Level 1 Domain Policies

CMMC Level 1 Access Control Policy - Provided by Strike Graph

CMMC Level 1 Media Protection Policy - Provided by Strike Graph

CMMC Level 1 System and Information Integrity Policy - Provided by Strike Graph

CMMC Level 1 System and Communications Protection Policy - Provided by Strike Graph

CMMC Level 1 Physical and Environmental Protection Policy - Provided by Strike Graph

CMMC Level 1 Identification and Authentication Policy - Provided by Strike Graph

CMMC Level 2 Core Domain Policies

CMMC Access Control Policy - Provided by Strike Graph

CMMC Security Assessment and Authorization Policy - Provided by Strike Graph

CMMC Security Awareness and Training Policy - Provided by Strike Graph

CMMC Risk Assessment Policy - Provided by Strike Graph

CMMC Personnel Security Policy - Provided by Strike Graph

CMMC Media Protection Policy - Provided by Strike Graph

CMMC System and Information Integrity Policy - Provided by Strike Graph

CMMC System and Communications Protection Policy - Provided by Strike Graph

CMMC Physical and Environmental Protection Policy - Provided by Strike Graph

CMMC Identification and Authentication Policy - Provided by Strike Graph

CMMC Incident Response Policy - Provided by Strike Graph

CMMC Maintenance Policy - Provided by Strike Graph

CMMC Configuration Management Policy - Provided by Strike Graph

CMMC Auditing and Accountability Policy - Provided by Strike Graph

Ancillary Policies and Standards for Level 2

CMMC Level 2 Ancillary Policies

CMMC Security Logging Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Secure System Development Life Cycle Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Secure Coding Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Sanitization Secure Disposal Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Remote Access Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Mobile Device Security - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Planning Policy - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Patch Management Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Information Security Risk Management Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Information Classification Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Information Security Policy - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Encryption Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Contingency Planning Policy - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Computer Security Threat Response Policy - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Authentication Tokens Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Account Management Access Control Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Acceptable Use of Information Technology Resources Policy - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Vulnerability Scanning Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC 80211 Wireless Network Security Standard - Provided by Strike Graph, CIS, and MS-ISAC

CMMC System and Services Acquisition Policy - Provided by Strike Graph, CIS, and MS-ISAC

CMMC Secure Configuration Standard - Provided by Strike Graph, CIS, and MS-ISAC

Stephanie Lorraine

Micah

Get started with the basics of the Strike Graph platform

Welcome to Strike Graph

How to add your teammates to the Strike Graph platform

Add users and invite teammates

Getting started with Strike Graph

Introductory overview of key compliance terms and getting started with Strike Graph

Getting started with Strike Graph video demonstration

Micah Spieler

Cayla Marshall

Laurel True-McCarthy

Learn how to navigate and leverage the Strike Graph platform

Strike Graph Basics

Risk Management Guide

A handful of custom risks can be added to the risk assessment to meet HIPAA requirements

Adding HIPAA risks to the Risk Management module

Learn your responsibilities as a risk owner

Risk ownership and scoring

Learn the basic principles of a risk assessment and how to manage one within the Strike Graph platform

Risk assessment basics

Glossary of security compliance terms

Create custom controls and evidence items, and link them to active criteria

Create custom controls and evidence items

Manage effective dates and expiration dates of items within the Evidence Repository

Update and manage evidence effective dates and expiration dates

How to access policy templates and best practices for customizing policies to your business

Access and utilize Strike Graph policy templates

Use the Audit Export feature for hand-off to an auditor or for your own records

Export your audit package

Understand how control statuses influence your framework coverage

Criteria marked as "Needs Attention" on the framework tree

How to deactivate controls and evidence items, and when it is appropriate to do so.

How to Deactivate Controls and Evidence Items

Create a project task list and link them to relevant items in your compliance program

Action Items (POAMs)

This article is your reference for all Strike Graph releases. Each update includes a summary of new features, enhancements, and fixes, organized chronologically from most recent to oldest. We update the product every 2 weeks.

Strike Graph Product Updates

User Management Guide

If you forget your password or need to change it, look here

How to change my password

How to designate editing permissions across the product and assign admins

Change user permissions

Remember to offboard a user after they leave your organization

Remove or deactivate a user

Control Library Guide

Customize control descriptions to align with your current business processes

Control descriptions

Guidance for assigning control progress flags and reasons to keep your control progress up-to-date

Control progress

Learn about control frequency and it differs from an evidence item's expiration schedule

Control frequency

Learn about why control owners and performers are not necessarily the same

Control owners vs. control performers

Learn your responsibilities as a control owner

Control ownership

Evidence Repository Guide

There are multiple ways to upload files to Strike Graph, but be aware of some limitations

How to successfully upload files

Vulnerability Assessments

There are two types of Information Security processes that assess vulnerabilities

Penetration tests vs. vulnerability scans

How to schedule your organization's Strike Graph pen test and answers to FAQs

Penetration test scheduling and FAQs

How to respond to and provide appropriate evidence regarding your penetration test results

Penetration test results

Key considerations to ensure that your organization pursues the appropriate penetration test and meets your specific objectives.

Penetration Test Scope Determination Guide

Information about other Strike Graph features

Additional Features

Upload your own framework and manage any compliance outcomes in your GRC

Custom Frameworks

Keep track of your Software Bill of Materials and scan for vulnerabilities

SBOM Manager

Learn about Security Questionnaires, Security Reports, and more

Trust Assets

Share your compliance documentation with the right people

Trust Center

Best practices for publishing and managing compliance content across your organization

Enterprise Content Management

Bugs happen! Tips on how to file a bug report

Filing a Bug Report

Track comments in your compliance instance in one central location

Comment Activity

Update multiple risks, controls, and evidence items at once with bulk editing

Bulk Editing

Provide insights into the evolution of risks, controls, or evidence items, including capturing decisions made along the way

Comments & Mentions

Specific input is needed from non-IT staff in IT compliance initiatives

Build your IT compliance dream team

View detailed presentations that outline key features of the platform and compliance journey  

Video Demonstrations

Visual demonstration of how to easily navigate Strike Graph's Risk Management feature

Risk Management Video Demonstration

Visual demonstration of how to utilize the Vendor Risk Register template

Vendor Risk Register Video Demonstration

A visual demonstration of how to utilize the Asset Inventory template

Asset Inventory Video Demonstration

Visual demonstration of how to easily customize and navigate your Strike Graph control library

Control Library Video Demonstration

Visual demonstration of how to easily utilize and navigate your Strike Graph Evidence Repository

Evidence Repository Video Demonstration

A visual demonstration of how to utilize the ISMS Statement of Applicability template

ISMS Statement of Applicability Video Demonstration

Visual demonstration of how to easily customize and navigate your Strike Graph Control Library

A visual demonstration of how to utilize the System Description template

System Description Video Demonstration

Introductory overview of key compliance terms, the SOC 2 journey, and getting started with Strike Graph

SOC 2 Onboarding Video Demonstration

Locate essential documents to assist with launching your organization’s IT compliance program. Already have policies in place? Consider reviewing our templates for language to enhance your organization’s existing documents.

Policy Template Library

Templates and tips for setting up your AIMS program

ISO 42001

AIMS Statement of Applicability

AIMS Scope and Context of the Organization Template

AIMS Risk Management Policy

AIMS Nonconformity and Corrective Action Plan Procedures

AIMS Monitoring and Measurement Plan Template

AIMS Internal Audit Procedures

AIMS Document Management Policy

AIMS Continuous Improvement Policy

Access templatized PCI documentation here

PCI Policy Collection

PCI Risk Assessment Policy and Procedures Template

PCI Policy

PCI Risk Assessment

PCI DSS Program Charter Examples

Cardholder Data Access Policy

Privacy Policy Templates (SOC 2, CCPA, GDPR, ISO 27701)

Example - Privacy Impact Assessment

CCPA Privacy Procedures Template

Example - CCPA Section External Privacy Policy Notice

Change of Subprocessor Procedures Template

Use this example template to prepare a Data Processing Agreement.

Data Processing Agreement Template

Refer to this example to demonstrate the privacy concept of legal/lawful basis

Example - Legal/Lawful Basis

Example - Notice of Change to Privacy Policy

PII Protection and Privacy Policy Template

Data Subject Request Handling and Notification Procedures Template

Cryptographic Controls and Key Management Policy Template

Access templatized HIPAA Security Rule (and Privacy Rule, if applicable) documentation

HIPAA Policy Templates 

HIPAA Privacy Rule Templates

General HIPAA Resources

HIPAA Security Rule Templates

Access templatized GDPR documentation here

GDPR

Use this template to create a ROPA or Record of Processing Activities

Record of Processing Activities or ROPA

Use this template to guide the creation of your organization's Data Processing Procedures

Data Processing Procedures Template

Refer to this example for documenting your own customer data deletion procedures