Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" or base document for different aspects of compliance as they would be defined by common audits such as ISO 27002 or SAS 70. Anyone who has experienced compliance document hell and come out alive... please tell me where you found some help.

share|improve this question

migrated from serverfault.com Nov 17 '11 at 16:55

This question came from our site for professional system and network administrators.

    
Thank you ... I wasn't even aware there was such a site, but now I know. –  Justin Shin Nov 17 '11 at 16:48

3 Answers 3

up vote 4 down vote accepted

You can get some good templates from SANS

share|improve this answer
1  
I've spent the last two years working on PCI compliance. SANS was the single best resource I found, other than literally copying and pasting items from the questionnaire into the language of my internal policies. –  Tim Brigham Nov 17 '11 at 21:38

disa.mil releases guidelines and checklists for security documentation as well. It's under SRR or STIG, their site is under maintenance at this moment, sorry for no link.

share|improve this answer

SAS70checklists.com has some good control mapping and compliance templates http://www.sas70checklists.com/tag/templates as does the NIST site itself http://www.nist.gov/index.html

There are a number of software packages that can help automate this process and generate reports. nCircle and IBM are two big players in the compliance management software arena.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.