Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução

Quarenta e cinco modelos de políticas e normas, prontos para adoção na sua organização.

Estes são modelos para o seu próprio programa, e não as regras da Associação: uma biblioteca de referência completa de documentos de segurança, privacidade, dados e operações com campos de mesclagem, para que você preencha os nomes da sua organização e os adote como seus. Cinco estão incluídos na filiação de Membro Associado. Visualize qualquer um deles; baixe o que o seu nível inclui.

Standard · AccessControlGratuito

Norma de Senhas

[STANDARD] [SME] Modern NIST SP 800-63B guidance; length over complexity; breach-corpus checking; no forced rotation.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityGratuito

Norma de E-mail e Mensagens Instantâneas

[STANDARD] [SME] SPF/DKIM/DMARC p=reject, MTA-STS, DANE, BIMI, secure email practices.

Version 2026.07 · updated Jul 2026

Preview
Standard · AccessControlProfissional

Access Management Standard

[STANDARD] [SME] Governance umbrella across Personnel, NHI, third-party, privileged access; AI agent identities.

Version 2026.07 · updated Jul 2026

Preview
Standard · AccessControlProfissional

Identity and Access Management Standard

[STANDARD] [SME] IAM technical mechanics; NIST SP 800-63B AAL, FIDO2, JML automation, PAM with JIT.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Cryptography Standard

[STANDARD] [SME] FIPS 140-3 transition, PQC FIPS 203/204/205, CBOM; AEAD, key management lifecycle.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Cloud Security Standard

[STANDARD] [SME] Landing zones, hub-spoke architecture, CMK, cloud-tenant access governance.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Endpoint Security Standard

[STANDARD] [SME] EDR/XDR, endpoint configuration baseline, hardening, device management.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Mobile Device Security Standard

[STANDARD] [SME] MDM/UEM, BYOD framework, mobile threat defence.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Mobile Communications and Messaging Standard

[STANDARD] [SME] Prohibited channels, FINRA/MiFID II business communications.

Version 2026.07 · updated Jul 2026

Preview
Standard · IncidentResponseProfissional

Cybersecurity Incident Response Standard

[STANDARD] [SME] CSIRT operations, 15-playbook catalogue, multi-jurisdiction notification matrix.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Vulnerability Response Standard

[STANDARD] [SME] Critical 15d / 72h-KEV remediation, PSIRT operations, EPSS prioritisation.

Version 2026.07 · updated Jul 2026

Preview
Standard · PhysicalSecurityProfissional

Secure Workplace Standard

[STANDARD] [SME] Physical workplace controls, clean desk, DIN 66399 P-4/P-5+ paper destruction.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Change Management Standard

[STANDARD] [SME] Change classification, CAB operations, DORA metrics (Change Failure Rate, MTTR).

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Use of Approved Technology Standard

[STANDARD] [SME] Technology approval discipline; parent of REF-002; EU AI Act.

Version 2026.07 · updated Jul 2026

Preview
Standard · DataPrivacyProfissional

Data Masking Standard

[STANDARD] [SME] 14-technique catalogue, FPE FF1 post-FF3-1 deprecation; non-production masking discipline.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Database Configuration Standard

[STANDARD] [SME] Per-engine baseline, RLS/CLS, TDE, database-tier authorization.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional

Logging and Alerting Standard

[STANDARD] [SME] 4-tier asset criticality logging, SIEM, detection content, MITRE ATT&CK.

Version 2026.07 · updated Jul 2026

Preview
Standard · BusinessContinuityProfissional

Backup and Archiving Standard

[STANDARD] [SME] 3-2-1-1-0 pattern, immutable backups, ransomware-resilient architecture.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional Executivo

Information Security Governance Standard

[STANDARD] [SME] Three Lines Model, 7-phase policy lifecycle, exception management, KRI/KPI.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional Executivo

Secure Development Lifecycle Standard

[STANDARD] [SME] OWASP ASVS, SBOM/SLSA, SCA, SAST, DAST, secure coding.

Version 2026.07 · updated Jul 2026

Preview
Standard · InformationSecurityProfissional Executivo

System Development Lifecycle Standard

[STANDARD] [SME] 7-gate SDLC framework, security architecture review, DPIA integration.

Version 2026.07 · updated Jul 2026

Preview
Standard · BusinessContinuityProfissional Executivo

BCDR Governance Standard

[STANDARD] [SME] BIA, RTO/RPO, 5-tier recovery, exercise programme, Crisis Leadership Committee.

Version 2026.07 · updated Jul 2026

Preview

Policy templates provided by a sponsor of the association.