+PL-10 [H] Baseline Selection

PL-10 [H] Baseline Selection

Control

Select a control baseline for the system.

Discussion

Control baselines are predefined sets of controls specifically assembled to address the protection needs of a group, organization, or community of interest. Controls are chosen for baselines to either satisfy mandates imposed by laws, executive orders, directives, regulations, policies, standards, and guidelines or address threats common to all users of the baseline under the assumptions specific to the baseline. Baselines represent a starting point for the protection of individuals’ privacy, information, and information systems with subsequent tailoring actions to manage risk in accordance with mission, business, or other constraints (see [PL-11](#pl-11) ). Federal control baselines are provided in [SP 800-53B](#46d9e201-840e-440e-987c-2c773333c752) . The selection of a control baseline is determined by the needs of stakeholders. Stakeholder needs consider mission and business requirements as well as mandates imposed by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. For example, the control baselines in [SP 800-53B](#46d9e201-840e-440e-987c-2c773333c752) are based on the requirements from [FISMA](#0c67b2a9-bede-43d2-b86d-5f35b8be36e9) and [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) . The requirements, along with the NIST standards and guidelines implementing the legislation, direct organizations to select one of the control baselines after the reviewing the information types and the information that is processed, stored, and transmitted on the system; analyzing the potential adverse impact of the loss or compromise of the information or system on the organization’s operations and assets, individuals, other organizations, or the Nation; and considering the results from system and organizational risk assessments. [CNSSI 1253](#4e4fbc93-333d-45e6-a875-de36b878b6b9) provides guidance on control baselines for national security systems.

Assessment Objective

a control baseline for the system is selected.

Assessment Method

Examine

Security and privacy planning policy procedures addressing system security and privacy plan development and implementation procedures addressing system security and privacy plan reviews and updates system design documentation system architecture and configuration documentation system categorization decision information types stored, transmitted, and processed by the system system element/component information stakeholder needs analysis list of security and privacy requirements allocated to the system, system elements, and environment of operation list of contractual requirements allocated to external providers of the system or system element business impact analysis or criticality analysis risk assessments risk management strategy organizational security and privacy policy federal or organization-approved or mandated baselines or overlays system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with security and privacy planning and plan implementation responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with responsibility for organizational risk management activities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by PL-10 [H] Baseline Selection – Assessment Procedure
is blocked by Secure Baseline Configurations