BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

PL-08(01) Defense in Depth

NIST SP 800-53 (controls) 5.2.0 against 5.1.1+u4
All changes in this version
unchanged PL part of PL-8

Title

Defense in Depth

Control

Design the security and privacy architectures for the system using a defense-in-depth approach that:
(a) Allocates [Assignment: controls] to [Assignment: locations and architectural layers] ; and
(b) Ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.

Discussion

Organizations strategically allocate security and privacy controls in the security and privacy architectures so that adversaries must overcome multiple controls to achieve their objective. Requiring adversaries to defeat multiple controls makes it more difficult to attack information resources by increasing the work factor of the adversary; it also increases the likelihood of detection. The coordination of allocated controls is essential to ensure that an attack that involves one control does not create adverse, unintended consequences by interfering with other controls. Unintended consequences can include system lockout and cascading alarms. The placement of controls in systems and organizations is an important activity that requires thoughtful analysis. The value of organizational assets is an important consideration in providing additional layering. Defense-in-depth architectural approaches include modularity and layering (see [SA-8(3)](#sa-8.3) ), separation of system and user functionality (see [SC-2](#sc-2) ), and security function isolation (see [SC-3](#sc-3)).

Parameters

pl-08.01_odp.01: controls
pl-08.01_odp.02: locations and architectural layers

Related controls

sc-2, sc-29, sc-3, sc-36

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).