03.15: Planning

Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI. Review and update policies and procedures [Assignment: organization-defined frequency].

Develop a system security plan that: Defines the constituent system components; Identifies the information types processed, stored, and transmitted by the system; Describes specific threats to the system that are of concern to the organization; Describes the operational environment for the system and any dependencies on or connections to other systems or system components; Provides…

Establish rules that describe the responsibilities and expected behavior for system usage and protecting CUI. Provide rules to individuals who require access to the system. Receive a documented acknowledgement from individuals indicating that they have read, understand, and agree to abide by the rules of behavior before authorizing access to CUI and the system. Review…