PL: Planning

Controls

PL-1: Policy and Procedures

Baseline(s):

  • Low
  • Moderate
  • High
  • Privacy

Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: [Assignment (one or more): organization-level, mission/business process-level, system-level] planning policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the implementation of…

PL-2: System Security and Privacy Plans

Baseline(s):

  • Low
  • Moderate
  • High
  • Privacy

Develop security and privacy plans for the system that: Are consistent with the organization’s enterprise architecture; Explicitly define the constituent system components; Describe the operational context of the system in terms of mission and business processes; Identify the individuals that fulfill system roles and responsibilities; Identify the information types processed, stored, and transmitted by the…

PL-4: Rules of Behavior

Baseline(s):

  • Low
  • Moderate
  • High
  • Privacy

Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and…

PL-7: Concept of Operations

Baseline(s):

(Not part of any baseline)

Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy; and Review and update the CONOPS [Assignment: organization-defined frequency].

PL-8: Security and Privacy Architectures

Baseline(s):

  • Moderate
  • High
  • Privacy

Develop security and privacy architectures for the system that: Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals; Describe how the architectures are integrated into and support…

PL-9: Central Management

Baseline(s):

  • Privacy

Centrally manage [Assignment: organization-defined controls and related processes].

PL-11: Baseline Tailoring

Baseline(s):

  • Low
  • Moderate
  • High

Tailor the selected control baseline by applying specified tailoring actions.