Totem's Cybersecurity Planning Tool

Description of Organizational Environment

Engage Privacy Controls (for HIPAA organizations)

Import and Export Documents

Two Control Sets:

• NIST 800-171

• HIPAA for Small Business 

Controls broken down into “Organizational Actions” (what NIST calls “Assessment Objectives”) for more explanation and granular plan/policy control.

Manage/Justify (for N/A) implementation details for each control at the Organizational Action level.

Mark each control as being implemented through:

• Policy

• Technology

• Hybrid (mix of policy and technology)

Policy/Hybrid controls automatically populated into “Policy Document” to be provided to implementers (e.g. outsource IT staff).

Upload/attach Compelling Evidence Artifacts

Supplemental Guidance/discussion of each Control

Global or Field-level Search

Mark Non-compliant Controls to Include in POA&M

Corrective Action Plan (CAP) Development

Title/ID CAP

Description of Weakness

Description of Action Plan

Designate Responsible Party

Set Completion Date

Manage POA&M through GUI

Export POA&M in US DoD Format (spreadsheet)

Mark Each Control as Compliant/Non-compliant

Assessor/Auditor Comments Field

Export SAR (spreadsheet)

Executive Compliance Summary

Upcoming POA&Ms

Highlight of Weak Areas

Description of Organizational Environment

Engage Privacy Controls (for HIPAA organizations)

Import and Export Documents

Multiple Control Sets:

• NIST 800-171

• CMMC

• HIPAA 

• ISO 27001

• GDPR

Controls broken down into “Organizational Actions” (what NIST calls “Assessment Objectives”) for more explanation and granular plan/policy control.

Risk Assessment (spreadsheet)

Incident Response Plan (Word doc)

Incident Response Report (Word doc)