Cybersecurity Risk Assessment with NIST

Introduction

30 Second Summary

Every business that stores customer data faces cybersecurity risks, from data breaches to ransomware attacks. Someone has to figure out which risks matter most and what to do about them.

In this project, you will step into the role of a Junior GRC Analyst at a fictional e-commerce startup and perform a complete cybersecurity risk assessment using the NIST Cybersecurity Framework 2.0.

What You'll Build

You'll assess cybersecurity risks for a fictional startup called ShopSecure, document its security posture, and draft a governance policy using the industry-standard NIST CSF 2.0 framework.

By the end of this project, you'll have:

• A structured Risk Register in Google Sheets that identifies, scores, and prioritizes cybersecurity risks.
• A Current Profile vs. Target Profile assessment mapping ShopSecure's security posture across all six CSF 2.0 Functions.
• A one-page Cybersecurity Governance Policy defining roles, risk tolerance, and oversight responsibilities.
• Secret Mission: Create an Incident Response Playbook with step-by-step procedures for handling a data breach.

Are there any prerequisites?

None. This project includes all the context you need to get started. You only need a free Google account to access Google Sheets and Google Docs.

Before We Start

Before We Start...

Set Up Your Workspace and Understand the Scenario

Before you can assess any risks, you need a structured workspace and a clear picture of the organization you're protecting.

In this step, you'll create your project folder in Google Drive, set up the two files you'll use throughout this project, and familiarize yourself with ShopSecure's situation.

In this step, get ready to:

• Create a Google Drive folder and two project files.
• Read and understand the ShopSecure company scenario.
• Open and bookmark the NIST CSF 2.0 Small Business Quick-Start Guide.

Create your workspace in Google Drive

Professional GRC work produces multiple interconnected documents. Keeping them in a single folder mirrors how compliance teams organize deliverables in the real world.

• Open your browser and navigate to drive.google.com.
• Sign in with your Google account.

Don't have a Google account?

You can create one for free at accounts.google.com. This project uses Google Sheets and Google Docs because they're free, collaborative, and mirror how GRC teams draft documentation in many organizations.

• Click New in the top-left corner of Google Drive.
• Select New folder.
• Name the folder ShopSecure GRC Project and click Create.
• Double-click the new folder to open it.

Now create the two files you'll use throughout this project.

• Click New, then select Google Sheets.
• Click the untitled spreadsheet name at the top-left and rename it to ShopSecure Risk Register.
• Go back to your ShopSecure GRC Project folder in Google Drive.
• Click New, then select Google Docs.
• Click the untitled document name at the top-left and rename it to ShopSecure Security Profile.
• Go back to your ShopSecure GRC Project folder.

You should now see both files listed inside your folder: ShopSecure Risk Register and ShopSecure Security Profile.

Files not showing in your folder?

If a file ended up in the root of your Google Drive instead of inside the folder, click and drag it into the ShopSecure GRC Project folder.

Make sure you opened the folder before clicking New. Files are created inside whichever folder you're currently viewing.

Help me organize my Google Drive files for this project.

Read the ShopSecure scenario

Every risk assessment starts with understanding the organization you're protecting. Read through ShopSecure's situation below carefully. You'll reference these details when identifying risks and assessing maturity later in the project.

The ShopSecure scenario

ShopSecure is a 25-person e-commerce startup selling electronics online. They process credit card payments and store customer data including names, emails, and shipping addresses.

They use cloud hosting on AWS and have a remote workforce using personal laptops. They currently have no formal cybersecurity program, no dedicated security staff, and no documented policies.

Your job as their Junior GRC Analyst is to assess their cybersecurity risk and build their GRC foundation from scratch.

Why does this scenario matter?

ShopSecure has multiple risk factors: they handle payment card data, store personal information, rely on cloud infrastructure, and have no security controls in place. This combination makes them a realistic candidate for a risk assessment.

Organizations like ShopSecure are exactly who the NIST CSF 2.0 Small Business Quick-Start Guide was written for.

Open the NIST CSF 2.0 Small Business Quick-Start Guide

The NIST Cybersecurity Framework 2.0 is the industry starting point for GRC programs. NIST provides a free Quick-Start Guide designed specifically for organizations that have no cybersecurity plan in place.

• Open a new browser tab and navigate to the NIST SP 1300 Quick-Start Guide:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf

• Bookmark this page in your browser. You'll reference it throughout the project.
• Skim through the first few pages to see how the guide is structured.

What is NIST SP 1300?

NIST SP 1300 is the Small Business Quick-Start Guide published alongside the CSF 2.0 framework. It provides small-to-medium sized businesses that have modest or no cybersecurity plans in place with considerations to kick-start their cybersecurity risk management strategy.

This guide is free, voluntary, and written in plain language. It will be your primary reference as you build ShopSecure's GRC documentation.

PDF not loading?

If the PDF doesn't open directly in your browser, try right-clicking the link and selecting Open in new tab. Some browsers download PDFs instead of displaying them. You can also search for "NIST SP 1300" to find it on the NIST website directly.

Help me access the NIST CSF 2.0 Quick-Start Guide PDF.

Your workspace is ready and you understand what ShopSecure is facing. Next up, you'll dive into the NIST CSF 2.0 framework structure and learn the six Functions that organize all cybersecurity activities.

Learn the NIST CSF 2.0 Framework Structure

Your workspace is ready and you understand ShopSecure's situation. Now it's time to learn the framework you'll use to assess their risk.

The NIST Cybersecurity Framework 2.0 organizes all of cybersecurity into a structured hierarchy: Functions, Categories, and Subcategories. Before you can assess ShopSecure's risks, you need to understand this structure and document it as a reference.

In this step, get ready to:

• Summarize the six CSF 2.0 Functions in your own words.
• Map the Categories under each Function with their official codes.
• Document the four CSF Tiers and assess where ShopSecure currently sits.

Understand the six Functions

The CSF 2.0 organizes cybersecurity into six high-level Functions. Think of these as the six major areas any organization needs to address for a complete cybersecurity program.

• Switch back to your ShopSecure Security Profile Google Doc.
• At the top of the document, type the heading NIST CSF 2.0 Overview and format it as Heading 1 using the toolbar dropdown.
• Below the heading, write a one-sentence summary for each of the six Functions listed below.

Use your bookmarked NIST CSF 2.0 Small Business Quick-Start Guide as a reference. Here is what each Function covers:

• Govern (GV) — The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.
• Identify (ID) — Help determine the current cybersecurity risk to the organization.
• Protect (PR) — Safeguards to manage the organization's cybersecurity risks are used.
• Detect (DE) — Possible cybersecurity attacks and compromises are found and analyzed.
• Respond (RS) — Actions regarding a detected cybersecurity incident are taken.
• Recover (RC) — Assets and operations affected by a cybersecurity incident are restored.

Why did NIST add Govern as a sixth Function?

The Govern Function was introduced in CSF 2.0 to emphasize the critical role of cybersecurity governance in managing and reducing risk. Previously, governance activities were embedded within the Identify Function, limiting visibility into how governance supports all aspects of a cybersecurity program.

For ShopSecure, this means governance is not just a background activity. It's the starting point that drives everything else.

• Write your summaries in your own words. You don't need to copy the official definitions word for word. The goal is to prove you understand what each Function is responsible for.

Keep it to one sentence each

A good summary captures the core purpose without listing every detail. For example, your Govern summary might be: "Establish and monitor the organization's cybersecurity strategy, policies, and roles." Short and clear is better than long and thorough.

Map the Categories under each Function

Each Function breaks down into Categories. Categories are groups of related cybersecurity outcomes. You'll reference these codes throughout the rest of the project when linking risks to specific areas of the framework.

• Below your Function summaries, add a subheading called Categories by Function and format it as Heading 2.
• List the Categories under each Function using the names and codes below.

Here are all the Categories organized by Function:

• Govern: Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities, and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV), Cybersecurity Supply Chain Risk Management (GV.SC).
• Identify: Asset Management (ID.AM), Risk Assessment (ID.RA), Improvement (ID.IM).
• Protect: Identity Management, Authentication, and Access Control (PR.AA), Awareness and Training (PR.AT), Data Security (PR.DS), Platform Security (PR.PS), Technology Infrastructure Resilience (PR.IR).
• Detect: Continuous Monitoring (DE.CM), Adverse Event Analysis (DE.AE).
• Respond: Incident Management (RS.MA), Incident Analysis (RS.AN), Incident Response Reporting and Communication (RS.CO), Incident Mitigation (RS.MI).
• Recover: Incident Recovery Plan Execution (RC.RP), Incident Recovery Communication (RC.CO).

• Type each Function as a bold label, then list its Categories with their codes in parentheses.
• Include the full Category name and its code for every entry. You'll use these codes in Steps 3 and 4 when mapping risks and profiles.

Why do the codes matter?

In professional GRC work, you reference CSF Categories and Subcategories by their codes (like PR.AT for Awareness and Training). This creates a shared language across risk registers, audit reports, and compliance documentation.

When you write "no employee security training" in a risk register, tagging it with PR.AT instantly tells anyone reading the document which part of the framework that risk relates to.

Document the CSF Tiers

The CSF Tiers describe how mature an organization's cybersecurity practices are. They help you measure where an organization is today and set realistic improvement goals.

• At the bottom of your overview section, add a subheading called CSF Tiers and format it as Heading 2.
• Document each of the four Tiers with a brief description:

• Tier 1 (Partial) — Informal and reactive. Risk management is ad hoc with limited awareness of cybersecurity risk.
• Tier 2 (Risk Informed) — Risk management is approved by leadership but not applied organization-wide.
• Tier 3 (Repeatable) — Policies are formally established and consistently applied across the organization.
• Tier 4 (Adaptive) — Practices adapt based on lessons learned and continuous improvement. The organization actively evolves its approach.

• Below the Tier descriptions, add a note: "ShopSecure currently sits at Tier 1 (Partial). They have no formal cybersecurity program, no documented policies, and no dedicated security staff."

What do the Tiers measure?

Tiers characterize the rigor of an organization's cybersecurity risk governance and management practices. They are not maturity levels you "pass" or "fail." They describe how integrated and formal an organization's approach is.

Most small businesses without a cybersecurity program start at Tier 1. Moving from Tier 1 to Tier 2 means leadership has acknowledged and approved a risk management approach. That's exactly what you're helping ShopSecure do in this project.

Your completed overview section should now have three parts: Function summaries, Categories by Function, and CSF Tiers. Double check that all six Functions, all 22 Categories with their codes, and all four Tiers are documented.

Not sure if your summaries are right?

Compare your one-sentence summaries against the NIST Quick-Start Guide you bookmarked. Each summary should capture the core purpose of the Function without going into Category-level detail.

Help me check if my NIST CSF 2.0 Function summaries accurately capture what each Function covers.

You now have a complete reference document for the NIST CSF 2.0 structure. Next up, you'll put this knowledge to work by building a risk register that identifies and scores ShopSecure's cybersecurity risks.

Build the Risk Register

You now have a solid understanding of how the NIST CSF 2.0 framework is structured. You know the six Functions, their Categories, and the four maturity Tiers.

Now it's time to put that knowledge to work. In this step, you'll build ShopSecure's Risk Register. This is the single most important deliverable in any GRC program because it captures every known risk, scores its severity, and tracks how the organization plans to address it.

In this step, get ready to:

• Set up a structured spreadsheet with 12 risk-tracking columns.
• Identify and score at least 8 cybersecurity risks for ShopSecure.
• Apply conditional formatting and sort risks by priority.

Set up the spreadsheet structure

A risk register needs consistent columns so every risk is evaluated using the same criteria. You'll create a header row with 12 fields that cover identification, scoring, and treatment planning.

• Return to your ShopSecure Risk Register spreadsheet in Google Sheets.
• In cell A1, type Risk ID.
• Continue across row 1, entering these headers in cells B1 through L1:

• Risk Description (B1).
• CSF Function (C1).
• CSF Category (D1).
• Likelihood (1-5) (E1).
• Impact (1-5) (F1).
• Risk Score (Likelihood x Impact) (G1).
• Risk Level (Critical/High/Medium/Low) (H1).
• Current Controls (I1).
• Recommended Treatment (J1).
• Owner (K1).
• Status (L1).

• Select all header cells (A1 through L1).
• Click the Bold button in the toolbar (or press Cmd+B on macOS or Ctrl+B on Windows).
• With the header row still selected, click the Fill color button (paint bucket icon) in the toolbar.
• Choose a dark color like navy or dark grey for the background.
• Click the Text color button (the "A" with a colored bar) and set the text to white so it's readable against the dark background.

What is a risk register?

A risk register is a living document that tracks every identified risk to an organization. It records what could go wrong, how likely it is, how severe the impact would be, and what the organization plans to do about it.

In professional GRC work, the risk register is the central artifact that leadership reviews to make funding and prioritization decisions. Everything else (policies, profiles, audits) feeds into or references it.

Your header row should now stand out clearly with bold white text on a dark background. This visual separation makes the register easy to scan when it's full of data.

Identify and document 8 risks

Now you'll think like a GRC Analyst. Review the ShopSecure scenario from Step 1 and identify at least 8 cybersecurity risks. Each risk maps to a specific CSF Function and Category from the framework overview you wrote in Step 2.

• In row 2, enter your first risk. Use RISK-001 as the Risk ID in column A.
• Fill in all 12 columns for this risk before moving to the next row.
• Continue adding risks in rows 3 through 9 (or further), incrementing the Risk ID each time (RISK-002, RISK-003, etc.).

Here are the 8 risks to document, based on the ShopSecure scenario:

• No multi-factor authentication on employee accounts. CSF Function: Protect. CSF Category: PR.AA (Identity Management, Authentication, and Access Control).
• No data encryption for customer payment data. CSF Function: Protect. CSF Category: PR.DS (Data Security).
• No employee security awareness training. CSF Function: Protect. CSF Category: PR.AT (Awareness and Training).
• No asset inventory of company devices and software. CSF Function: Identify. CSF Category: ID.AM (Asset Management).
• No incident response plan. CSF Function: Respond. CSF Category: RS.MA (Incident Management).
• No regular data backups. CSF Function: Recover. CSF Category: RC.RP (Incident Recovery Plan Execution).
• No monitoring for unauthorized access. CSF Function: Detect. CSF Category: DE.CM (Continuous Monitoring).
• No documented governance or risk management policy. CSF Function: Govern. CSF Category: GV.PO (Policy).

How do I score Likelihood and Impact?

Use a scale of 1 (very low) to 5 (very high) for both Likelihood and Impact. Likelihood measures how probable it is that this risk will actually happen. Impact measures how much damage it would cause if it did.

For example, "no data encryption for payment data" at an e-commerce company might score Likelihood 4 (attackers actively target payment data) and Impact 5 (breach would cause legal liability, fines, and loss of customer trust). That gives a Risk Score of 20.

There's no single "correct" score. What matters is that your reasoning is consistent and defensible. Real GRC analysts discuss scores with stakeholders to calibrate them.

• For the Risk Score column (G), multiply the Likelihood value by the Impact value for each row.
• For the Risk Level column (H), classify each risk based on its score: 16-25 is Critical, 10-15 is High, 5-9 is Medium, 1-4 is Low.
• For the Current Controls column (I), enter None for each risk. ShopSecure has no cybersecurity program in place.
• For Recommended Treatment (J), write a brief action that would reduce the risk (e.g., "Implement MFA for all employee accounts").
• For Owner (K), assign a responsible role (e.g., IT Lead, GRC Analyst, CEO).
• For Status (L), enter Open for all risks since none have been addressed yet.

Use a formula for Risk Score

Instead of calculating manually, enter =E2*F2 in cell G2 and drag the formula down to all your risk rows. Google Sheets will calculate the score automatically for each risk.

Prioritize and classify

A wall of numbers is hard to scan. Conditional formatting adds color coding so leadership can instantly see which risks are critical. This is how GRC professionals present risk data to executives who don't have time to read every cell.

• Select all cells in the Risk Score column (G2 through G9, or however many risks you have).
• Click Format in the top menu bar.
• Click Conditional formatting.

You'll need to create four separate conditional formatting rules. Add them one at a time:

• Click Add another rule (or use the initial rule). Set the format rules to Is between, enter 16 and 25, and set the fill color to red. This marks Critical risks.
• Add another rule. Set it to Is between 10 and 15, with an orange fill color. This marks High risks.
• Add another rule. Set it to Is between 5 and 9, with a yellow fill color. This marks Medium risks.
• Add another rule. Set it to Is between 1 and 4, with a green fill color. This marks Low risks.
• Click Done to apply all rules.

Your Risk Score column should now show colors corresponding to each risk's severity level.

• Now sort the entire register by Risk Score. Select all your data (header row and all risk rows).
• Click Data in the top menu bar.
• Click Sort range, then select Advanced range sorting options.
• Check the Data has header row box.
• Set the sort column to Risk Score (Likelihood x Impact) and select Z to A (descending order, so the highest scores appear at the top).
• Click Sort.

Why sort by Risk Score?

Sorting from highest to lowest puts the most urgent risks at the top. When you present this register to ShopSecure's leadership, they immediately see what needs attention first without scrolling through the entire document.

This prioritized view is how GRC professionals turn raw risk data into actionable recommendations. The red (Critical) and orange (High) risks at the top become the organization's immediate focus.

Your completed risk register should now show a color-coded, prioritized list of ShopSecure's cybersecurity risks. The highest-scoring risks appear at the top with red or orange highlights.

Conditional formatting not showing colors?

Make sure you selected the correct cell range (just the score values in column G, not the header). Also verify that your Risk Score values are numbers, not text. If you typed the scores manually, click a cell and check that the value doesn't have leading spaces or quotation marks.

Help me fix my conditional formatting in Google Sheets

Your risk register is complete. You now have a structured, prioritized view of ShopSecure's cybersecurity risks that maps directly to the NIST CSF 2.0 framework. Next up, you'll use this register to assess ShopSecure's current security posture and define where they need to be in 12 months.

Create the Current and Target Profiles

Your risk register identifies individual threats, but leadership needs a bigger picture. They want to know: where does ShopSecure stand overall, and where should it be in 12 months?

That's what Organizational Profiles answer. You'll assess ShopSecure's current cybersecurity posture across all six Functions, then set realistic improvement targets. This gap analysis is a core GRC skill that shows exactly where to invest time and resources.

In this step, get ready to:

• Build a four-column profile table in your Security Profile document.
• Document ShopSecure's current security gaps for each CSF Function.
• Set realistic 12-month target tiers with specific improvement outcomes.

Build the profile structure

A CSF Organizational Profile maps your security posture to the framework's six Functions. You'll create a table that compares where ShopSecure is today against where it should be.

• Switch back to your ShopSecure Security Profile Google Doc.
• Below your existing NIST CSF 2.0 Overview section, add a new heading called Current Profile vs. Target Profile.
• Click Insert in the top menu bar.
• Select Table and choose a 4x7 table (4 columns, 7 rows: 1 header row + 6 Function rows).
• In the header row, type these four column headers: CSF Function, Current State, Current Tier, Target Tier.
• Bold the header row to match the formatting style of your risk register.
• In the first column, add a row for each of the six Functions: Govern, Identify, Protect, Detect, Respond, Recover.

What is an Organizational Profile?

A CSF Organizational Profile is a mechanism for describing an organization's current and/or target cybersecurity posture in terms of the CSF Core's outcomes.

The Current Profile shows where you are today. The Target Profile shows where you want to be. The gap between them drives your improvement roadmap.

Assess the Current Profile

Now you'll document what ShopSecure actually does (or doesn't do) for each Function. Based on the scenario, ShopSecure has no formal cybersecurity program, so every Function sits at Tier 1 (Partial).

• In the Current State column for the Govern row, write: "No formal cybersecurity strategy, no documented risk tolerance, no assigned cybersecurity roles."
• For Identify, write: "No asset inventory of devices or software, no formal risk assessment process, no improvement tracking."
• For Protect, write: "No MFA on employee accounts, no encryption for customer payment data, no security awareness training, employees use personal laptops with no endpoint protection."
• For Detect, write: "No monitoring for unauthorized access attempts, no log review process, no alerting mechanisms."
• For Respond, write: "No incident response plan, no defined roles for incident handling, no communication procedures for breaches."
• For Recover, write: "No data backup procedures, no disaster recovery plan, no post-incident review process."
• In the Current Tier column, enter Tier 1 (Partial) for all six rows.

Why is everything Tier 1?

Tier 1 (Partial) means cybersecurity risk management is informal and reactive. Since ShopSecure has no documented policies, no dedicated security staff, and no formal processes, every Function qualifies as Partial.

This is common for small businesses starting from scratch. The value of documenting this honestly is that it creates a clear baseline for measuring future progress.

Reference your risk register

The gaps you're writing in the Current State column should align with the risks you identified in your risk register. For example, the "no MFA" risk in your register maps directly to the Protect Function's current state.

Define the Target Profile

The Target Profile sets a realistic 12-month goal for ShopSecure. You're not aiming for perfection. You're aiming for meaningful, achievable improvement.

• In the Target Tier column, enter Tier 2 (Risk Informed) for the Govern, Identify, Detect, Respond, and Recover rows.
• For the Protect row, enter Tier 3 (Repeatable). This Function gets a higher target because it directly impacts customer data protection.

Now add specific outcomes to the Target Tier column for each Function. These outcomes define what "success" looks like in 12 months.

• For Govern (Target: Tier 2), add: "Establish a documented cybersecurity policy (GV.PO), assign a cybersecurity compliance coordinator (GV.RR), define organizational risk tolerance (GV.RM)."
• For Identify (Target: Tier 2), add: "Create and maintain an inventory of all hardware, software, and data assets (ID.AM), conduct annual risk assessments (ID.RA)."
• For Protect (Target: Tier 3), add: "Implement MFA for all employees (PR.AA), deploy encryption for customer data at rest and in transit (PR.DS), conduct quarterly security awareness training (PR.AT)."
• For Detect (Target: Tier 2), add: "Implement logging and monitoring for critical systems (DE.CM), establish a process for reviewing security alerts (DE.AE)."
• For Respond (Target: Tier 2), add: "Document an incident response plan with defined roles (RS.MA), establish incident analysis procedures (RS.AN), define communication protocols for security incidents (RS.CO)."
• For Recover (Target: Tier 2), add: "Implement automated daily backups with tested recovery procedures (RC.RP), define post-incident communication plan for stakeholders (RC.CO)."

Why is Protect set higher than the other Functions?

ShopSecure processes credit card payments and stores customer data. A failure in the Protect Function has direct legal, financial, and reputational consequences. Setting Protect to Tier 3 (Repeatable) means ShopSecure commits to formally established policies that are consistently applied.

The other Functions at Tier 2 (Risk Informed) means risk management practices are approved by management but may not yet be organization-wide. This is a realistic first-year goal for a 25-person startup.

Review your completed table. You should see all six Functions listed with specific current gaps, a Current Tier of Tier 1 (Partial) across the board, and Target Tiers with measurable outcomes for each.

Table looking messy or hard to read?

If your Current State or Target Tier text is getting cut off, widen those columns by dragging the column borders. The Current State and Target Tier columns need the most space since they contain descriptive text.

Make sure each Category code (like PR.AA or DE.CM) appears in parentheses after the relevant outcome so a reader can trace each improvement back to the framework.

Help me format my Current Profile vs. Target Profile table in Google Docs so it's readable and professional.

Your profile assessment is complete. You now have a clear before-and-after picture of ShopSecure's cybersecurity posture. Next up, you'll draft the governance policy that ties all of your GRC deliverables together into an actionable system.

Draft the Cybersecurity Governance Policy

Your Current Profile and Target Profile now paint a clear picture of where ShopSecure stands and where it needs to go. The gap between Tier 1 and your target tiers gives leadership a concrete improvement roadmap.

In this step, you'll draft a governance policy that ties everything together. A governance policy is the top-level document that defines who is responsible for cybersecurity, how risk decisions are made, and what standards everyone must follow.

In this step, get ready to:

• Create a new Google Docs file with a professional policy header.
• Write policy content covering purpose, scope, roles, risk strategy, and policy statements.
• Link all three GRC deliverables into an interconnected system.

Create the policy document

Every formal policy document starts with a header that identifies what it is, who owns it, and when it takes effect. This metadata is critical for auditors and compliance reviewers who need to verify whether a policy is current.

• In Google Docs, create a new blank document.
• Name the document ShopSecure Cybersecurity Governance Policy.
• Move this file into your ShopSecure GRC Project folder in Google Drive.

At the top of the document, add a header block with the following details:

• Company name: ShopSecure.
• Document title: Cybersecurity Governance Policy.
• Version: v1.0.
• Effective date: today's date.
• Document owner: GRC Analyst (that's you).

• Below the header, add these section headings (leave them empty for now):

• Purpose.
• Scope.
• Roles and Responsibilities.
• Risk Management Strategy.
• Policy Statements.
• Review Schedule.

Why does every policy need a header?

When auditors review an organization's cybersecurity program, the first thing they check is whether policies are current and have clear ownership. A header with version numbers and effective dates proves the document is actively maintained.

Without this metadata, a policy might be dismissed as outdated or unofficial. Version control also helps track how the policy evolves as ShopSecure matures its security program.

Write the policy content

Now you'll fill in each section with content that establishes ShopSecure's cybersecurity expectations. Each section serves a specific purpose in the governance hierarchy.

• Under Purpose, write a statement that this policy establishes ShopSecure's cybersecurity risk management strategy aligned with NIST CSF 2.0.
• Under Scope, define that this policy applies to all employees, contractors, and systems at ShopSecure.

• Under Roles and Responsibilities, assign the following roles:

• CEO as the risk owner (ultimately accountable for cybersecurity risk decisions).
• GRC Analyst (you) as the compliance coordinator (maintains documentation, tracks risk, ensures policy adherence).
• IT Lead as the technical implementer (deploys and manages security controls).

Why separate the risk owner from the implementer?

In GRC, the person who accepts risk (the CEO) is different from the person who fixes it (the IT Lead). This separation ensures that risk decisions are made at the right level of authority, not buried in technical teams.

• Under Risk Management Strategy, define ShopSecure's risk tolerance. Write something like: "ShopSecure has low tolerance for risks that could expose customer payment data."
• In the same section, reference your risk register as the central document for tracking and prioritizing identified risks.

• Under Policy Statements, write 3-5 actionable statements. Each statement should be tied to a CSF subcategory. For example:

• "All employees must complete cybersecurity awareness training within 30 days of hire" (PR.AT).
• "Multi-factor authentication is required on all employee accounts" (PR.AA).
• "Customer payment data must be encrypted at rest and in transit" (PR.DS).
• "Security incidents must be reported to the GRC Analyst within 1 hour of discovery" (RS.CO).
• "All company assets must be inventoried and classified quarterly" (ID.AM).

Write your own statements

The examples above are a starting point. Feel free to write your own policy statements based on the risks you identified in your risk register. The key is that each statement is specific, measurable, and traceable back to a CSF Category code.

• Under Review Schedule, state that this policy will be reviewed quarterly for the first year, then annually after that.

Why quarterly reviews in year one?

ShopSecure is building its cybersecurity program from scratch. During the first year, the organization will learn a lot about what works and what doesn't. Quarterly reviews allow the policy to evolve quickly as the team gains experience.

Once the program stabilizes, annual reviews are sufficient to keep the policy current without creating unnecessary overhead.

Link your deliverables together

GRC documents don't exist in isolation. In a real organization, the governance policy drives the risk assessment, which feeds the security profile, which informs priority actions. Your final task is to make this relationship explicit.

• At the bottom of your policy document, add a new section heading called Related Documents.
• List your two other deliverables by name: ShopSecure Risk Register and ShopSecure Security Profile.
• Below the document list, write a brief paragraph (2-3 sentences) explaining how these documents form an interconnected system.

Your paragraph should explain the flow: the governance policy establishes the rules and risk tolerance, the risk register identifies and tracks specific threats against those rules, and the security profile measures progress toward the target state. Each document feeds the others.

Why does this interconnection matter?

In a real organization, a standalone policy or risk register is far less useful than a connected set of documents. When an auditor asks "How do you manage risk?", you can point to the policy. When they ask "What specific risks exist?", you point to the register. When they ask "What's your improvement plan?", you point to the profile.

This is what makes GRC a system, not just a collection of paperwork.

Not sure what to write in your paragraph?

Focus on the relationship between the three documents. Think of it like a chain: the policy defines "what we care about" (governance), the register identifies "what could go wrong" (risk), and the profile tracks "how mature are we" (compliance).

If you're stuck, help me write the Related Documents paragraph for my governance policy.

Secret mission

Create an Incident Response Playbook

You've built the governance, risk, and compliance foundation for ShopSecure. Now it's time to build the operational response piece. What happens when a real breach occurs? Create a Data Breach Incident Response Playbook that connects your GRC documentation to actionable response procedures.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

This project uses only free Google Workspace tools (Google Sheets and Google Docs), so there are no ongoing costs regardless of what you choose.

Resources you used:

• Google Drive folder: ShopSecure GRC Project.
• Google Sheets file: ShopSecure Risk Register.
• Google Docs file: ShopSecure Security Profile.
• Google Docs file: ShopSecure Cybersecurity Governance Policy.
• Google Docs file: ShopSecure Incident Response Playbook - Data Breach (Secret Mission).

Keep everything running

No action needed. Choose this if you want to continue refining your GRC deliverables or use them as portfolio pieces.

• Your files remain in the ShopSecure GRC Project folder in Google Drive.
• You can share the folder with others by right-clicking it and selecting Share.
• Consider downloading copies as PDF or DOCX for your portfolio.

Pause - I'll come back to this later

Move your files out of the way so they don't clutter your Drive, but keep them accessible for later.

• In Google Drive, right-click the ShopSecure GRC Project folder.
• Select Organize, then Move to relocate it into a parent folder like Archives or Completed Projects.
• Close any open browser tabs for these files.

Delete - I don't want to use this again

Remove all project files from your Google Drive permanently.

• In Google Drive, right-click the ShopSecure GRC Project folder.
• Select Move to trash. This moves the folder and all files inside it to the trash.
• In the left sidebar, click Trash.
• Click Empty trash at the top right to permanently delete all trashed files.

What about the NIST PDF bookmark?

The NIST CSF 2.0 Small Business Quick-Start Guide is a free public document. You can remove the bookmark from your browser, or keep it for future reference at no cost.

Nice Work!

Nice Work!

You just completed your first real GRC project. You went from a blank page to a full set of professional cybersecurity compliance documents using the NIST Cybersecurity Framework 2.0.

You've learned how to:

• Build a Risk Register that identifies, scores, and prioritizes cybersecurity risks using a structured methodology with likelihood and impact scoring.
• Create Current and Target Profiles that map an organization's security maturity to the NIST CSF 2.0's six Functions and four Tiers.
• Draft a Cybersecurity Governance Policy that ties together roles, risk tolerance, and compliance requirements into an interconnected system of GRC documentation.
• Create an Incident Response Playbook that operationalizes your GRC framework with step-by-step breach response procedures, a RACI matrix, and timeline requirements.

Ready to quiz yourself?