Micah

Micah Spieler

Stephanie Lorraine

Cayla Marshall

Elliott Harnagel

Find specific resources for various frameworks, advice on specific audits, and more.

Frameworks and Standards

Access Life Sciences policy templates and content here

Life Sciences Collection

Manage cybersecurity risk associated with medical devices.

Risk Management SOP

How to run a data integrity audit for software as a medical device.

Data Integrity Audit Report for Production Software as a Medical Device

How to establish and maintain cybersecurity governance for medical devices.

Cybersecurity Governance SOP

How to integrate security practices into the design and development of medical devices.

Secure Design and Development SOP

How to manage cybersecurity risks associated with third-party components.

Third-Party Risk Management SOP

How to securely deploy and configure medical devices.

Secure Deployment and Configuration SOP

How to securely dispose of medical devices and associated data.

Secure Disposal SOP

How to test and validate cybersecurity measures in medical devices.

Cybersecurity Testing and Validation SOP

How to manage vulnerabilities throughout the medical device lifecycle.

Vulnerability Management SOP

Comprehensive Medical Device Cybersecurity Policy

How to document an SRS submission to the FDA.

Software as a Medical Device Submission Templates

How to respond to incidents and ensure business continuity for medical devices.

Incident Response and Business Continuity SOP

How to develop and maintain cybersecurity documentation for medial devices.

Documentation and Maintenance SOP

Access FedRamp and NIST 800-53 guidance here

NIST 800-53 & FedRamp

NIST Secure System Development Life Cycle Policy template

This article provides links to external sources for policy templates. These resources will support NIST-based frameworks.

NIST Policy Template Guides

Use this table to identify items withdrawn from v4 and where they ended up in v5

NIST 800-53 v4 to v5 differences

Use establish Access Control Policy or Role Access Management

NIST Access Control Policy template

Learn about the SOC 2 criteria, how to efficiently prepare for an audit, and the general SOC 2 audit process 

SOC 2 Framework & Audit Guidance

Understand the SOC 2 Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy

The five SOC 2 Trust Services Criteria explained

Ensure you and your team stay audit-ready

Best Practices for Maintaining SOC 2 Compliance Between Audits

Compliance Implementation & Maintenance

Audit Process

This article explains the SOC 2 concept of "reasonable" control coverage

SOC 2’s control coverage concept

A guide to understanding the different sections and their content

How to Read a SOC 2 Report

Develop your organization's Section III of the SOC 2 Report 

SOC 2 System Description Template & Guidance

A step-by-step guide for completing the CSOC (Complementary Subservice Organization Controls) section of a System Description

Complementary Subservice Organization Controls

Update your System Description before the forthcoming audit; this checklist includes AICPA guidance issued in October 2022

Updating the System Description

How to use the Strike Graph System Description template and what to do if an additional Trust Services Criteria is in scope

System Description Template

Learn about the intended audience of this document and what should be included

System Description Basics

Learn the difference between controls performed by a contractor/vendor and those performed by subservice organizations

Contractor/Vendor vs. Subservice Organization Controls

Complementary User Entity Controls or "CUECs"

Access CMMC and NIST 800-171 guidance here

NIST 800-171 & CMMC

The Strike Graph Self Assessment feature can be used to create SPRS scores necessary for compliance with CMMC.

How to Use Strike Graph to Generate SPRS Scores for CMMC Compliance

Learn about NIST 800-53A and NIST 800-171A - the assessment criteria for CMMC and FedRamp.

Assessment Criteria for NIST 800-171 and NIST 800-53

Visit this page for NIST 800-171 - compliant policy templates

Policy Templates for NIST 800-171 & CMMC

Use this list to update controls in the Strike Graph Library for NIST 800-171 and for tips on what needs to be included in documentation.

NIST 800-171 Tips and Tricks

Get started with the basics of the Strike Graph platform

Welcome to Strike Graph

How to add your teammates to the Strike Graph platform

Add users and invite teammates

Getting started with Strike Graph

Introductory overview of key compliance terms and getting started with Strike Graph

Getting started with Strike Graph video demonstration

Laurel True-McCarthy

Learn how to navigate and leverage the Strike Graph platform

Strike Graph Basics

Risk Management Guide

A handful of custom risks can be added to the risk assessment to meet HIPAA requirements

Adding HIPAA risks to the Risk Management module

Learn your responsibilities as a risk owner

Risk ownership and scoring

Learn the basic principles of a risk assessment and how to manage one within the Strike Graph platform

Risk assessment basics

Choose how Strike Graph combines likelihood and impact into a risk score, and tailor the ratings, ranges, and colors to your organization

Risk scoring methodologies and custom risk scales

Glossary of security compliance terms

Create custom controls and evidence items, and link them to active criteria

Create custom controls and evidence items

Manage effective dates and expiration dates of items within the Evidence Repository

Update and manage evidence effective dates and expiration dates (FAQ)

How to access policy templates and best practices for customizing policies to your business

Access and utilize Strike Graph policy templates

Use the Audit Export feature for hand-off to an auditor or for your own records

Export your audit package

Understand how control statuses influence your framework coverage

Criteria marked as "Needs Attention" on the framework tree

How to deactivate controls and evidence items, and when it is appropriate to do so.

How to Deactivate Controls and Evidence Items

Create a project task list and link them to relevant items in your compliance program

Action Items (POAMs)

This article is your reference for all Strike Graph releases. Each update includes a summary of new features, enhancements, and fixes, organized chronologically from most recent to oldest. We update the product every 2 weeks.

Strike Graph Product Updates

User Management Guide

How to reset your Strike Graph password from the login page, and what to do if you use SSO

How to change my password

Understand what each role can do, and change a user's role in your workspace

User roles and permissions

Remember to offboard a user after they leave your organization

Remove or deactivate a user

Manage Strike Graph access and roles directly from your identity provider

SCIM provisioning for SSO

Set up SSO for your organization so your team can log in to Strike Graph with their existing company credentials

Single Sign-On (SSO) with SAML

Add an extra layer of security to your Strike Graph login with multi-factor authentication

Multi-Factor Authentication (MFA)

Control Library Guide

Customize control descriptions to align with your current business processes

Control descriptions

Guidance for assigning control progress flags and reasons to keep your control progress up-to-date

Control progress

Learn about control frequency and it differs from an evidence item's expiration schedule

Control frequency

Learn about why control owners and performers are not necessarily the same

Control owners vs. control performers

Learn your responsibilities as a control owner

Control ownership

Evidence Repository Guide

There are multiple ways to upload files to Strike Graph, but be aware of some limitations

How to successfully upload files

Vulnerability Assessments

There are two types of Information Security processes that assess vulnerabilities

Penetration tests vs. vulnerability scans

How to schedule your organization's Strike Graph pen test and answers to FAQs

Penetration test scheduling and FAQs

How to respond to and provide appropriate evidence regarding your penetration test results

Penetration test results

Key considerations to ensure that your organization pursues the appropriate penetration test and meets your specific objectives.

Penetration Test Scope Determination Guide

Information about other Strike Graph features

Additional Features

Upload your own framework and manage any compliance outcomes in your GRC

Custom Frameworks

Keep track of your Software Bill of Materials and scan for vulnerabilities

SBOM Manager

Learn about Security Questionnaires, Security Reports, and more

Trust Assets

Share your compliance documentation with the right people

Trust Center

Best practices for publishing and managing compliance content across your organization

Enterprise Content Management

Bugs happen! Tips on how to file a bug report

Filing a Bug Report

Track comments in your compliance instance in one central location

Comment Activity

Update multiple risks, controls, and evidence items at once with bulk editing

Bulk Editing

Provide insights into the evolution of risks, controls, or evidence items, including capturing decisions made along the way

Comments & Mentions

Specific input is needed from non-IT staff in IT compliance initiatives

Build your IT compliance dream team

Your compliance home base — see where your program stands and what needs your attention, tailored to your role

Compliance Dashboard

Use the Monitoring Dashboard to see evidence health, control status, and risk exposure in one place

Monitoring Dashboard

View detailed presentations that outline key features of the platform and compliance journey  

Video Demonstrations

Visual demonstration of how to easily navigate Strike Graph's Risk Management feature

Risk Management Video Demonstration

Visual demonstration of how to utilize the Vendor Risk Register template

Vendor Risk Register Video Demonstration

A visual demonstration of how to utilize the Asset Inventory template

Asset Inventory Video Demonstration

Visual demonstration of how to easily customize and navigate your Strike Graph control library

Control Library Video Demonstration

Visual demonstration of how to easily utilize and navigate your Strike Graph Evidence Repository

Evidence Repository Video Demonstration

A visual demonstration of how to utilize the ISMS Statement of Applicability template

ISMS Statement of Applicability Video Demonstration

Visual demonstration of how to easily customize and navigate your Strike Graph Control Library

A visual demonstration of how to utilize the System Description template

System Description Video Demonstration

Introductory overview of key compliance terms, the SOC 2 journey, and getting started with Strike Graph

SOC 2 Onboarding Video Demonstration

Stephanie

Locate essential documents to assist with launching your organization’s IT compliance program. Already have policies in place? Consider reviewing our templates for language to enhance your organization’s existing documents.