NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| PL-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy that: (a) Addresses purpose, scop | |
| PL-02 | System Security and Privacy Plans | a. Develop security and privacy plans for the system that: 1. Are consistent with the organization’s enterprise architecture; 2. Explicitly define the constituent system components; 3. Describe the operational context of the system in terms | |
| PL-02(01) in PL-2 |
Concept of Operations withdrawn | ||
| PL-02(02) in PL-2 |
Functional Architecture withdrawn | ||
| PL-02(03) in PL-2 |
Plan and Coordinate with Other Organizational Entities withdrawn | ||
| PL-03 | System Security Plan Update withdrawn | ||
| PL-04 | Rules of Behavior | a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b. Receive a documented acknowledgment fro | |
| PL-04(01) in PL-4 |
Social Media and External Site/Application Usage Restrictions | Include in the rules of behavior, restrictions on: (a) Use of social media, social networking sites, and external sites/applications; (b) Posting organizational information on public websites; and (c) Use of organization-provided identifier | |
| PL-05 | Privacy Impact Assessment withdrawn | ||
| PL-06 | Security-related Activity Planning withdrawn | ||
| PL-07 | Concept of Operations | a. Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy; and b. Review and update the CONOPS [Assignment: frequency]. | |
| PL-08 | Security and Privacy Architectures | a. Develop security and privacy architectures for the system that: 1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; 2. Describe the requirem | |
| PL-08(01) in PL-8 |
Defense in Depth | Design the security and privacy architectures for the system using a defense-in-depth approach that: (a) Allocates [Assignment: controls] to [Assignment: locations and architectural layers] ; and (b) Ensures that the allocated controls oper | |
| PL-08(02) in PL-8 |
Supplier Diversity | Require that [Assignment: controls] allocated to [Assignment: locations and architectural layers] are obtained from different suppliers. | |
| PL-09 | Central Management | Centrally manage [Assignment: controls and related processes]. | |
| PL-10 | Baseline Selection | Select a control baseline for the system. | |
| PL-11 | Baseline Tailoring | Tailor the selected control baseline by applying specified tailoring actions. |
17 of 1196.