Assessment Objective
Determine if:
- PL-02a.
- PL-02a.01
- PL-02a.01[01] a security plan for the system is developed that is consistent with the organization’s enterprise architecture;
- PL-02a.01[02] a privacy plan for the system is developed that is consistent with the organization’s enterprise architecture;
- PL-02a.02
- PL-02a.02[01] a security plan for the system is developed that explicitly defines the constituent system components;
- PL-02a.02[02] a privacy plan for the system is developed that explicitly defines the constituent system components;
- PL-02a.03
- PL-02a.03[01] a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes;
- PL-02a.03[02] a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes;
- PL-02a.04
- PL-02a.04[01] a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;
- PL-02a.04[02] a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;
- PL-02a.05
- PL-02a.05[01] a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;
- PL-02a.05[02] a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;
- PL-02a.06
- PL-02a.06[01] a security plan for the system is developed that provides the security categorization of the system, including supporting rationale;
- PL-02a.06[02] a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale;
- PL-02a.07
- PL-02a.07[01] a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization;
- PL-02a.07[02] a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization;
- PL-02a.08
- PL-02a.08[01] a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;
- PL-02a.08[02] a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;
- PL-02a.09
- PL-02a.09[01] a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;
- PL-02a.09[02] a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;
- PL-02a.10
- PL-02a.10[01] a security plan for the system is developed that provides an overview of the security requirements for the system;
- PL-02a.10[02] a privacy plan for the system is developed that provides an overview of the privacy requirements for the system;
- PL-02a.11
- PL-02a.11[01] a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;
- PL-02a.11[02] a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;
- PL-02a.12
- PL-02a.12[01] a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions;
- PL-02a.12[02] a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions;
- PL-02a.13
- PL-02a.13[01] a security plan for the system is developed that includes risk determinations for security architecture and design decisions;
- PL-02a.13[02] a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions;
- PL-02a.14
- PL-02a.14[01] a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups];
- PL-02a.14[02] a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups];
- PL-02a.15
- PL-02a.15[01] a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation;
- PL-02a.15[02] a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
- PL-02a.01
- PL-02b.
- PL-02b.[01] copies of the plans are distributed to [Assignment: personnel or roles];
- PL-02b.[02] subsequent changes to the plans are communicated to [Assignment: personnel or roles];
- PL-02c. plans are reviewed [Assignment: frequency];
- PL-02d.
- PL-02d.[01] plans are updated to address changes to the system and environment of operations;
- PL-02d.[02] plans are updated to address problems identified during the plan implementation;
- PL-02d.[03] plans are updated to address problems identified during control assessments;
- PL-02e.
- PL-02e.[01] plans are protected from unauthorized disclosure;
- PL-02e.[02] plans are protected from unauthorized modification.
Assessment Methods
Examine
- Security and privacy planning policy
- procedures addressing system security and privacy plan development and implementation
- procedures addressing security and privacy plan reviews and updates
- enterprise architecture documentation
- system security plan
- privacy plan
- records of system security and privacy plan reviews and updates
- security and privacy architecture and design documentation
- risk assessments
- risk assessment results
- control assessment documentation
- other relevant documents or records
Interview
- Organizational personnel with system security and privacy planning and plan implementation responsibilities
- system developers
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for system security and privacy plan development, review, update, and approval
- mechanisms supporting the system security and privacy plan
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | PL-02 System Security and Privacy Plans |