Navigate

CCI-003057

CCI-003057 Definition

Develop security and privacy plans for the system that describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed describes within the security plan the security controls in place or planned for meeting those requirements including a rationale for the tailoring and supplementation decisions.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed describes within the security plan the security controls in place or planned for meeting those requirements including a rationale for the tailoring and supplementation decisions.

Compelling Evidence

1.) System security plan (SSP).

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003057.

Control	Description
PL-2	The organization: a: Develops a security plan for the information system that: 1: Is consistent with the organization’s enterprise architecture; 2: Explicitly defines the authorization boundary for the system; 3: Describes the operational context of the information system in terms of missions and business processes; 4: Provides the security categorization of the information system including supporting rationale; 5: Describes the operational environment for the information system and relationships with or connections to other information systems; 6: Provides an overview of the security requirements for the system; 7: Identifies any relevant overlays, if applicable; 8: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and 9: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation; b: Distributes copies of the security plan and communicates subsequent changes to the plan to [organization-defined personnel or roles]; c: Reviews the security plan for the information system [organization-defined frequency]; d: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and e: Protects the security plan from unauthorized disclosure and modification.

Control

Description

PL-2

The organization:

a: Develops a security plan for the information system that:
- 1: Is consistent with the organization’s enterprise architecture;
- 2: Explicitly defines the authorization boundary for the system;
- 3: Describes the operational context of the information system in terms of missions and business processes;
- 4: Provides the security categorization of the information system including supporting rationale;
- 5: Describes the operational environment for the information system and relationships with or connections to other information systems;
- 6: Provides an overview of the security requirements for the system;
- 7: Identifies any relevant overlays, if applicable;
- 8: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and
- 9: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

b: Distributes copies of the security plan and communicates subsequent changes to the plan to [organization-defined personnel or roles];

c: Reviews the security plan for the information system [organization-defined frequency];

d: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

e: Protects the security plan from unauthorized disclosure and modification.