Template
Annual Review Checklist
The once-a-year pass that keeps a program from quietly going stale.
Beginner
30 min
Free
NIST CSF
ISO 27001
Published · v1.0.0 · 2026-08-01
Exercise
Practice Writing Policy Statements
Turn vague intentions into policy statements that are testable and enforceable.
- Intended audience
- Anyone drafting documentation
- Difficulty
- Intermediate
- Estimated time
- 20 minutes
- Access
- Free
NIST CSF
ISO 27001
All industries
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Rewrite vague policy language into statements that are specific, testable, and enforceable.
- Apply the four required components of a testable policy statement: subject, obligation, measurable condition, and owner.
- Identify the evidence artifact that would prove compliance with each rewritten statement.
- Recognize when a business cannot yet meet a policy statement and route that gap into a POA&M rather than softening the language.
- Distinguish between aspirational language and enforceable policy.
Rewrite these
- 'We take security seriously.'
- 'Employees should be careful with passwords.'
- 'Access is reviewed regularly.'
- 'Backups are performed.'
A testable statement has
- A subject (who).
- An obligation (must, will).
- A measurable condition (what, how often).
- An owner or system named.
Key takeaways
- A testable policy statement must name who is responsible, what they must do, how often, and what owns the outcome.
- Vague statements like 'we take security seriously' cannot be assessed and therefore provide no compliance value.
- Every policy statement should have a corresponding evidence artifact that could be produced on request.
- If a business cannot currently meet a written policy statement, the honest response is to log it as a plan of action item rather than water down the wording.
- Well-written policy statements make future assessments faster because assessors can test them directly against evidence.
Practice workspace
Hint: Example: 'Account access is reviewed quarterly by each manager and recorded on the access review worksheet.'
Hint: If no artifact exists, the statement is not yet testable.
Hint: That becomes a POA&M item, not a rewrite.
Practice exercise. Your entries stay in this browser, are not submitted anywhere, and are not part of your compliance record.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
NIST · 2.0
Cybersecurity Framework (CSF) 2.0(opens in a new tab)Link last confirmed 2026-02-01
NIST · Revision 3
SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information(opens in a new tab)Link last confirmed 2026-02-01
Federal Trade Commission
Start with Security: A Guide for Business(opens in a new tab)Link last confirmed 2026-02-01
Earn a Certificate of Training Completion
Complete every section, acknowledge, and pass the knowledge check.
Sections opened0 of 2
This certificate recognizes completion of educational training material only. It is not a professional certification, accreditation, license, compliance assessment, audit result, or attestation of compliance with any law, regulation, or contract requirement. ComplianceAnvil is not a certification authority, accreditation body, assessor, or law firm.
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
Practice exercise. Your entries stay in this browser, are not submitted anywhere, and are not part of your compliance record.
Related resources
Matched on shared frameworks, topics, and program packs.
Exercise
Classify Sample Data
Sort realistic records into classification levels and defend the handling rules that follow.
Intermediate
15 min
Free
NIST SP 800-171
ISO 27001
Published · v1.0.0 · 2026-08-01
Exercise
Complete a Readiness Scorecard
Score yourself honestly across six areas and turn the two lowest into a short plan.
Beginner
15 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Template
Information Security Policy
The parent policy that states what your organization protects, who is responsible, and how the rest of your documentation hangs together.
Intermediate
45 min
Free
NIST CSF
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Guide
Preparing for Vendor Questionnaires
How to answer customer security questionnaires quickly, accurately, and without overpromising.
Intermediate
12 min
Free
SOC 2
NIST CSF
Published · v1.0.0 · 2026-08-01
Template
Risk Register
Track the risks you know about, who owns them, and what you decided to do — including accepting them.
Intermediate
35 min
Free
NIST CSF
ISO 27001
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.