Frameworks / NIST SP 800-66 Rev 2 / 164.316(a) NIST SP 800-66 Rev 2
Documentation
NIST SP 800-66 Rev 2 164.316(a): Policies and Procedures (Standard) Implement reasonable and appropriate policies and procedures to comply with the Security Rule standards. NIST recommends a managed policy hierarchy with ownership, version control, and review cadence.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 79 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
11.4.1 11.4.1 Penetration testing methodology defined and implemented 12.1.1 12.1.1 Overall information security policy established and disseminated 12.1.2 12.1.2 Security policy reviewed annually and updated as needed 12.10.1 12.10.1 Incident response plan ready for activation 2.1.1 2.1.1 Requirement 2 policies and procedures governed 2.1.2 2.1.2 Requirement 2 roles and responsibilities assigned 3.3.3 3.3.3 Issuer SAD storage limited, justified and encrypted 4.1.2 4.1.2 Requirement 4 roles and responsibilities assigned 9.1.2 9.1.2 Requirement 9 roles and responsibilities assigned 3.1.1 3.1.1 Requirement 3 policies and procedures maintained and in use 8.1.2 8.1.2 Requirement 8 roles and responsibilities assigned 4.2.1 General 4.3.1 General 5.2.1 Establishing the business continuity policy 6.1.1 Determining risks and opportunities 7.5.2 Creating and updating 7.5.3 Control of documented information 8.1 Operational planning and control 8.2.1 General 8.4.4 Business continuity plans 9.3.2 Management review input 6.11.1 Security requirements of information systems 6.2.1 Management direction for information security 6.3 Organization of information security 6.9.1 Operational procedures and responsibilities 7.4 Privacy by design and privacy by default 8.2 Conditions for collection and processing 8.4 Privacy by design and privacy by default 5.1 Policies for information security 5.2 Information security roles and responsibilities 5.34 Privacy and protection of personal identifiable information (PII) 5.36 Compliance with policies, rules and standards for information security 5.37 Documented operating procedures 5.1 Policies for information security 5.37 Documented operating procedures 8.26 Application security requirements 8.27 Secure system architecture and engineering principles C5-OIS-02 Information Security Policy C5-SP-01 Documentation, communication and provision of policies and instructions C5-SP-02 Review and Approval of Policies and Instructions NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13) SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12) SOC2-PI1.1 PI1.1 Quality information about processing objectives, data definitions and specifications CPS234-19 Information Security Policy Framework CPS234-P19 Policy Direction to All Responsible Parties ASBv3-GS-3 Define and implement data protection strategy ASBv3-GS-5 Define and implement security posture management strategy CIS-15.2 Establish and Maintain a Service Provider Management Policy CIS-16.4 Establish and Manage an Inventory of Third-Party Software Components PL-1 Policy and Procedures PL-2 System Security and Privacy Plans PL-1 Policy and Procedures PL-2 System Security and Privacy Plans CPS220-P36 Monitoring of Policy Review Dates and Ownership CPS230-37 Service Provider Management Policy SEC01-BP03 Identify and validate control objectives AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data APP-1 APP 1 - Open and transparent management of personal information CFTC-SS-1 Program of Risk Analysis and Oversight Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Documentation Query this from an agent The graph holds this control, the 79 it maps to, and the evidence behind each claim, over MCP and REST.