Frequently Asked Questions
Everything You Need to Know
Answers to the most common questions about the CPGF methodology, policy templates, and how Cyber Policy Pros works.
About the CPGF Methodology
What is the Cybersecurity Policy Governance Framework (CPGF)?
The CPGF is a governance framework and production methodology developed by Cyber Policy Pros for creating audit-aligned cybersecurity policy documentation. It defines how policies are structured, tiered by maturity level, maintained over time, and mapped to control requirements across 23 compliance frameworks. Every policy template in our library is built using the CPGF.
What makes CPGF different from just buying policy templates?
Generic templates give you documents. The CPGF gives you a governance structure. Every policy produced under the CPGF is mapped to specific control requirements, tiered across a 5-level Rogers Policy Maturity Model (RPMM), and designed to satisfy auditor expectations, not just check a compliance box. The result is documentation that holds up under scrutiny.
What is the Rogers Policy Maturity Model (RPMM)?
The Rogers Policy Maturity Model (RPMM) organizes policy documentation across five maturity levels, from Level 1 (Foundational) through Level 5 (Optimized). Each level represents a progressively stronger security posture and level of policy governance rigor. Organizations select the level appropriate to their compliance requirements and organizational maturity. Products are grouped into three tiers: Foundational (L1-2), Intermediate (L1-3), and Advanced (L4-5).
Policy Templates and Packages
What frameworks do your policy packages cover?
Our current library covers 24 frameworks including NIST SP 800-53 Rev 5, CMMC 2.0, HIPAA, PCI-DSS v4.0, SOC 2 Type II, ISO 27001:2022, FedRAMP, FISMA, NIST CSF 2.0, NIST 800-171, DFARS, NERC CIP, GDPR, CCPA/CPRA, GLBA, SOX, HITECH, NIST 800-82, OMB Circulars, and CISA BODs. We add new frameworks regularly.
How are the templates delivered?
All policy templates are delivered as fully formatted Microsoft Word documents (.docx). Each document includes the complete policy structure, purpose and scope statements, policy statements mapped to the relevant control requirements, roles and responsibilities, enforcement language, definitions, and framework cross-references.
Is the documentation audit-aligned without additional work?
Our templates are authored by certified professionals and structured to meet auditor expectations across each framework. However, each template requires customization by your subject matter experts before audit submission. You will need to incorporate environment-specific details, system names, operational configurations, and any organization-specific controls. The CPGF structure is designed to make that customization effort minimal and clearly guided, but the SME review and tailoring step is required. What you receive is a governance-quality foundation, not a fill-in-the-blank form.
How long does it take to receive my documents?
Template packages available in the shop are delivered immediately upon purchase. For custom engagements requested through the Get a Quote form, typical delivery is 3 to 7 business days depending on scope.
Can I customize the templates for my organization?
Yes. All templates are delivered in editable Word format and are designed to be customized with your organization name, environment-specific details, system names, and any additional controls your program requires. The CPGF structure remains intact while you fill in your specifics.
Pricing and Purchasing
What does Fixed Fee Pricing mean?
Fixed fee means the price you see is the price you pay, with no hourly billing, no scope creep charges, and no surprise invoices. Each package is priced at a flat rate based on the framework and maturity tier selected.
Do you offer bundle pricing for multiple frameworks?
Yes. Organizations managing two or more compliance programs can request bundle pricing through the Get a Quote form. Bundle discounts of 15 to 25 percent are available depending on the number of frameworks and tiers selected.
What are the pricing tiers?
Foundational packages (RPMM Levels 1-2) start from $149. Intermediate packages (RPMM Levels 1-3) start from $199. Advanced packages (RPMM Levels 4-5) start from $249. All-Inclusive packages covering all RPMM levels start from $299. Pricing varies by framework based on the number of policy areas and controls covered. All pricing is listed in the shop.
How long does delivery take?
All policy template packages are delivered automatically via secure email after purchase. No waiting, no manual processing. You will receive your complete package within minutes of completing your order.
Can I purchase multiple frameworks together?
Yes. Pre-built industry bundles are available for Healthcare, Financial Services, Critical Infrastructure, and Enterprise GRC. Bundles save 15-25% compared to purchasing frameworks individually. You can purchase bundles directly in the shop.
How is the pricing determined?
Pricing is fixed per framework based on the scope and depth of coverage. Larger frameworks with more control families and policy areas are priced higher. All packages are fixed-fee with no hourly billing. What you see is what you pay.
Do the policies need to be customized after delivery?
Our documents provide complete, framework-aligned policy content that covers all required control areas. You will need to customize them with your organization name, specific system names, and environment details. The substantive compliance content and control statements are complete upon delivery.
What if I need ongoing support after delivery?
All packages include email support for the duration stated in your tier. For ongoing compliance management, we offer annual retainer agreements that include policy updates as frameworks change, quarterly reviews, and priority support.
How do I know which tier is right for me?
Take our free 2-minute Readiness Quiz - it analyzes your organization size, industry, and compliance requirements and recommends the right tier and framework package for your specific situation.
Working with Cyber Policy Pros
Do you offer consulting in addition to templates?
Yes. In addition to self-service template packages, we offer consulting engagements for organizations that need hands-on support implementing their compliance program, preparing for audits, or developing custom policy documentation outside our standard library.
How do I get started?
The fastest path is to take the free Readiness Assessment at cyberpolicypros.net/readiness-assessment/. It identifies your policy maturity requirements and recommends the appropriate CPGF tier for your environment. You can also browse packages directly or request a quote for a custom engagement.
Ordering and Delivery
Do I need to prepare anything before taking the quiz?
No. The quiz is designed to work with the information you already know - your company size, industry, and what compliance requirement is driving your project. No technical preparation is needed.
What happens after I place my order?
Your complete policy package is delivered automatically via email within minutes of purchase. All documents arrive as editable Word (.docx) files ready for you to customize with your organization name, system names, and environment-specific details.
Can I request changes to the documents after delivery?
All documents are delivered as fully editable Word files, so your team can make any changes directly. Customizations like inserting your company name, system names, and personnel titles are done by your team in the Word documents. No revision rounds are needed since you have full control of the files.
What format are the documents delivered in?
All documents are delivered as fully editable Microsoft Word (.docx) files . You own the files - customize them, add your branding, and update them as your organization evolves. No subscriptions, no portals, no lock-in.
Is the documentation really audit-aligned without additional work?
Yes - that is the core promise of Cyber Policy Pros. Our documentation is written by certified professionals who have conducted and supported dozens of audits. Our templates are authored by certified professionals and structured to satisfy auditor expectations. Each template requires customization by your subject matter experts -- including environment-specific details, system names, and operational configurations -- before being submitted for audit. The CPGF structure ensures that customization effort is minimal and clearly guided.
Still have questions?
Use the Get a Quote form and we will respond within one business day.