Exercise
Practice Writing Policy Statements
Turn vague intentions into policy statements that are testable and enforceable.
Intermediate
20 min
Free
NIST CSF
ISO 27001
Published · v1.0.0 · 2026-08-01
Template
Annual Review Checklist
The once-a-year pass that keeps a program from quietly going stale.
- Intended audience
- Program owners
- Difficulty
- Beginner
- Estimated time
- 30 minutes
- Access
- Free
NIST CSF
ISO 27001
All industries
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Run through the full set of annual review items covering policies, owners, evidence, and vendors.
- Re-approve or formally note no change for every policy during the review cycle.
- Refresh evidence and close or re-date open POA&M items as part of the same cycle.
Review items
- Re-approve every policy, or record why it did not change.
- Confirm control owners are still the right people.
- Refresh evidence older than one year.
- Close or re-date open POA&M items.
- Re-run the risk assessment.
- Confirm training completion for current staff.
- Review vendors and remove ones you no longer use.
Key takeaways
- An annual review should re-approve every policy or explicitly record why it did not change, rather than letting policies age silently.
- Confirming that control owners are still the right people prevents responsibility from drifting after staff turnover.
- Evidence older than one year should be refreshed so it still reflects the current environment.
- Open POA&M items need to be closed or re-dated each year rather than carried forward indefinitely without action.
- Reviewing and removing unused vendors during this cycle keeps the vendor inventory accurate.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
NIST · 2.0
Cybersecurity Framework (CSF) 2.0(opens in a new tab)Link last confirmed 2026-02-01
NIST · Revision 3
SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems(opens in a new tab)Link last confirmed 2026-02-01
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This template is provided for readiness and educational purposes. Organizations should review and adapt it for their environment.
Related resources
Matched on shared frameworks, topics, and program packs.
Guide
Preparing for Vendor Questionnaires
How to answer customer security questionnaires quickly, accurately, and without overpromising.
Intermediate
12 min
Free
SOC 2
NIST CSF
Published · v1.0.0 · 2026-08-01
Template
Information Security Policy
The parent policy that states what your organization protects, who is responsible, and how the rest of your documentation hangs together.
Intermediate
45 min
Free
NIST CSF
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Template
Risk Register
Track the risks you know about, who owns them, and what you decided to do — including accepting them.
Intermediate
35 min
Free
NIST CSF
ISO 27001
Published · v1.0.0 · 2026-08-01
Guide
Building a Security Program from Scratch
A ninety-day sequence for a business with nothing written down yet — cheapest, highest-impact work first.
Beginner
14 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Exercise
Classify Sample Data
Sort realistic records into classification levels and defend the handling rules that follow.
Intermediate
15 min
Free
NIST SP 800-171
ISO 27001
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.