Doc:NIST SP 800-53Ar1 FPD Appendix F/Enhanced/PL

PL-1 SECURITY PLANNING POLICY AND PROCEDURES

Control: The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]:

a. A formal, documented security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

b. Formal, documented procedures to facilitate the implementation of the security planning policy and associated security planning controls.

Supplemental Guidance: This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the security planning family. The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The security planning policy addresses the overall policy requirements for confidentiality, integrity, and availability and can be included as part of the general information security policy for the organization. Security planning procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the security planning policy. Related control: PM-9.

Control Enhancements: None.

Determine if: (i) the organization develops and formally documents security planning policy; (ii) the organization security planning policy addresses: purpose; scope; roles and responsibilities; management commitment; coordination among organizational entities; and compliance; (iii) the organization disseminates formal documented security planning policy to elements within the organization having associated security planning roles and responsibilities; (iv) the organization develops and formally documents security planning procedures; (v) the organization security planning procedures facilitate implementation of the security planning policy and associated security planning controls; and (vi) the organization disseminates formal documented security planning procedures to elements within the organization having associated security planning roles and responsibilities.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with security planning responsibilities].

Determine if: (i) the organization defines the frequency of security planning policy reviews/updates; (ii) the organization reviews/updates security planning policy in accordance with organization-defined frequency; and (iii) the organization defines the frequency of security planning procedure reviews/updates; (iv) the organization reviews/updates security planning procedures in accordance with organization-defined frequency.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with security planning responsibilities].

PL-2 SYSTEM SECURITY PLAN

Control: The organization:

a. Develops a security plan for the information system that:

- Is consistent with the organization's enterprise architecture;

- Explicitly defines the authorization boundary for the system;

- Describes the operational context of the information system in terms of missions and business processes;

- Provides the security categorization of the information system including supporting rationale;

- Describes the operational environment for the information system;

- Describes relationships with or connections to other information systems;

- Provides an overview of the security requirements for the system;

- Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring and supplementation decisions; and

- Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

b. Reviews the security plan for the information system [Assignment: organization-defined frequency]; and

c. Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments.

Supplemental Guidance: The security plan contains sufficient information (including specification of parameters for assignment and selection statements in security controls either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan and a subsequent determination of risk to organizational operations and assets, individuals, other organizations, and the Nation if the plan is implemented as intended. Related controls: PM-1, PM-7, PM-8, PM-9, PM-11.

Control Enhancements:

Determine if: (i) the organization develops a security plan for the information system that: is consistent with the organization's enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of mission and business processes; provides the security categorization of the information system including supporting rationale; describes the operational environment for the information system; describes relationships with or connections to other information systems; provides an overview of the security requirements for the system; describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring and supplemental decisions; and is reviewed and approved by the authorizing official or designated representative prior to plan implementation; (ii) the organization defines the frequency of security plan reviews; (iii) the organization reviews the security plan in accordance with the organization-defined frequency; and (iv) the organization updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing security plan development and implementation; procedures addressing security plan reviews and updates; enterprise architecture documentation; security plan for the information system; records of security plan reviews and updates; other relevant documents or records].

Interview: [SELECT FROM: Organization personnel with security planning and plan implementation responsibilities for the information system].

(1) The organization:

(a) Develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: (i) the purpose of the system; (ii) a description of the system architecture; (iii) the security authorization schedule; and (iv) the security categorization and associated factors considered in determining the categorization; and

(b) Reviews and updates the CONOPS [Assignment: organization-defined frequency].

Enhancement Supplemental Guidance: The security CONOPS may be included in the security plan for the information system.

Determine if: (i) the organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: the purpose of the system; a description of the system architecture; the security authorization schedule; and the security categorization and associated factors considered in determining the categorization; (ii) the organization defines the frequency of reviews and updates to the CONOPS; and (iii) the organization reviews and updates the CONOPS in accordance with the organization-defined frequency.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing security CONOPS development; procedures addressing security CONOPS reviews and updates; security CONOPS for the information system; security plan for the information system; records of security CONOPS reviews and updates; other relevant documents or records].

Interview: [SELECT FROM: Organization personnel with security planning and plan implementation responsibilities for the information system].

(2) The organization develops a functional architecture for the information system that identifies and maintains:

(a) External interfaces, the information being exchanged across the interfaces, and the protection mechanisms associated with each interface;

(b) User roles and the access privileges assigned to each role;

(c) Unique security requirements;

(d) Types of information processed, stored, or transmitted by the information system and any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance; and

(e) Restoration priority of information or information system services.

Enhancement Supplemental Guidance: Unique security requirements for the information system include, for example, encryption of key data elements at rest. Specific protection needs for the information system include, for example, the Privacy Act and Health Insurance Portability and Accountability Act.

Determine if the organization develops a functional architecture for the information system that identifies and maintains: external interfaces, the information being exchanged across the interfaces, and the protection mechanisms associated with each interface; user roles and the access privileges assigned to each role; unique security requirements; types of information processed, stored, or transmitted by the information system and any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance; and restoration priority of information or information system services.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; access control policy; contingency planning policy; security plan for the information system; contingency plan for the information system; information system design documentation; other relevant documents or records].

Interview: [SELECT FROM: Organization personnel with security planning and plan implementation responsibilities for the information system].

[Withdrawn: Incorporated into PL-2].

[Withdrawn: Incorporated into PL-2].

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

[Withdrawn: Incorporated into PL-2].

PL-4 RULES OF BEHAVIOR

Control: The organization:

a. Establishes and makes readily available to all information system users, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; and

b. Receives signed acknowledgment from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system.

Supplemental Guidance: The organization considers different sets of rules based on user roles and responsibilities, for example, differentiating between the rules that apply to privileged users and rules that apply to general users. Electronic signatures are acceptable for use in acknowledging rules of behavior. Related control: PS-6.

Control Enhancements:

Determine if: (i) the organization establishes the rules that describe information system user responsibilities and expected behavior with regard to information and information system usage; (ii) the organization makes the rules available to all information system users; and (iii) the organization receives a signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing rules of behavior for information system users; rules of behavior; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel who are authorized users of the information system and have signed rules of behavior].

(1) The organization includes in the rules of behavior, explicit restrictions on the use of social networking sites, posting information on commercial websites, and sharing information system account information.

Determine if the organization includes in the rules of behavior: explicit restrictions on the use of social networking sites; posting information on commercial websites; and sharing information system account information.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing rules of behavior for information system users; rules of behavior; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel who are authorized users of the information system and have signed rules of behavior].

PL-5 PRIVACY IMPACT ASSESSMENT

Control: The organization conducts a privacy impact assessment on the information system in accordance with OMB policy.

Supplemental Guidance: None.

Control Enhancements: None.

Determine if: (i) the organization conducts a privacy impact assessment on the information system; and (ii) the privacy impact assessment is in accordance with OMB policy.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing privacy impact assessments on the information system; privacy impact assessment; other relevant documents or records].

PL-6 SECURITY-RELATED ACTIVITY PLANNING

Control: The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation), organizational assets, and individuals.

Supplemental Guidance: Security-related activities include, for example, security assessments, audits, system hardware and software maintenance, and contingency plan testing/exercises. Organizational advance planning and coordination includes both emergency and nonemergency (i.e., planned or nonurgent unplanned) situations.

Control Enhancements: None.

Determine if the organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation), organizational assets, and individuals.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing security-related activity planning for the information system; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with security planning and plan implementation responsibilities].