Skip to main content

Policies to Framework Mapping

Each framework has its own set of requirements, but the policies they expect overlap heavily. This page maps common policies to the frameworks that expect them, so you can see which documents you need for the standards you are pursuing and which ones will carry you across every framework you add later.

A well-scoped set of foundational policies satisfies effectively every security and privacy framework. Framework-specific policies only enter the picture for specialized regimes (HIPAA's privacy rules, federal control catalogs, AI management standards, and the like).

In the table, All means the policy maps to effectively every commonly pursued framework.

PolicyFrameworks
Acceptable Use PolicyAll
Asset Management PolicyAll
Backup PolicyAll
Business Continuity PlanAll
Change Management PolicyAll
Code of ConductAll
Data Classification PolicyAll
Data Protection PolicyAll
Data Retention PolicyAll
Disaster Recovery PlanAll
Encryption PolicyAll
Incident Response PlanAll
Information Security PolicyAll
Logging and Monitoring PolicyAll
Network Security PolicyAll
Password PolicyAll
Physical Security PolicyAll
Risk Assessment PolicyAll
Software Development Life Cycle PolicyAll
System Access Control PolicyAll
Vendor Management PolicyAll
Vulnerability Management PolicyAll
AI Governance PolicyNIST AI RMF, ISO/IEC 42001
AI Risk Management PolicyNIST AI RMF, ISO/IEC 42001
AI System Development and Evaluation PolicyNIST AI RMF, ISO/IEC 42001
Artificial Intelligence Management System (AIMS) PlanISO/IEC 42001
Breach Notification PolicyHIPAA
Business Associate PolicyHIPAA
Information Governance PolicyDORA, CCM, HITRUST
Internal Privacy PolicyISO/IEC 27701, HITRUST
Information Security Management System (ISMS) PlanISO/IEC 27001
ISMS and Privacy Information Management System (PIMS) PlanISO/IEC 27701
Maintenance Management PolicyFedRAMP, CMMC, NIST 800-53, NIST 800-171, NIST CSF, DORA, CIS Controls, HITRUST
PCI DSS Compliance PolicyPCI DSS v4
Personal Data Management PolicyCCPA, CPRA, GDPR, HITRUST
Privacy, Use, and Disclosure PolicyHIPAA
Public Cloud Personally Identifiable Information (PII) Protection PolicyISO/IEC 27018, NIST AI RMF, HITRUST
Shared Responsibility PolicyISO/IEC 27017, ISO/IEC 27018, CCM
System and Information Integrity PolicyFedRAMP, CMMC, NIST 800-53, NIST 800-171, NIST CSF, DORA, CIS Controls, HITRUST, Essential Eight
System and Services Acquisition PolicyFedRAMP, CMMC, NIS 2, NIST 800-53, NIST 800-171, DORA
System Security Planning PolicyFedRAMP, CMMC, NIST 800-53, NIST 800-171, CCM

How to Use This​

If you are pursuing your first framework, start with the universal set: those policies are the working core of a compliance program, and every framework you add later will reuse them. Then add the framework-specific documents only for the regimes you actually operate under; there is no reason to maintain a Business Associate Policy if you never touch HIPAA.

Because one policy satisfies many frameworks, write each policy once and map it to controls across the standards you pursue rather than maintaining per-framework copies. See Policies and Procedures for guidance on consolidating and writing these documents, and the import guide for bringing existing policies into Openlane.