Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

pl-2

system security plan

assessment objective:

Determine if the organization:  

pl-2(a)  

develops a security plan for the information system that:

pl-2(a)(1)

is consistent with the organization’s enterprise architecture;

pl-2(a)(2)

explicitly defines the authorization boundary for the system;

pl-2(a)(3)

describes the operational context of the information system in terms of missions and business processes;

pl-2(a)(4)

provides the security categorization of the information system including supporting rationale;

pl-2(a)(5)

describes the operational environment for the information system and relationships with or connections to other information systems;

pl-2(a)(6)

provides an overview of the security requirements for the system;

pl-2(a)(7)

identifies any relevant overlays, if applicable;

pl-2(a)(8)

describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring and supplemental decisions;

pl-2(a)(9)

is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

pl-2(b)  

pl-2(b)[1]

defines personnel or roles to whom copies of the security plan are to be distributed and subsequent changes to the plan are to be communicated;

pl-2(b)[2]

distributes copies of the security plan and communicates subsequent changes to the plan to organization-defined personnel or roles;

pl-2(c)

pl-2(c)[1]

defines the frequency to review the security plan for the information system;

pl-2(c)[2]

reviews the security plan for the information system with the organization-defined frequency;

pl-2(d)

updates the plan to address:

pl-2(d)[1]

changes to the information system/environment of operation;

pl-2(d)[2]

problems identified during plan implementation;

pl-2(d)[3]

problems identified during security control assessments;

pl-2(e)

protects the security plan from unauthorized:

pl-2(e)[1]

disclosure; and

pl-2(e)[2]

modification.

potential assessment methods and objects:

Examine: [select from: Security planning policy; procedures addressing security plan development and implementation; procedures addressing security plan reviews and updates; enterprise architecture documentation; security plan for the information system; records of security plan reviews and updates; other relevant documents or records].

Interview: [select from: Organizational personnel with security planning and plan implementation responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Organizational processes for security plan development/review/update/approval; automated mechanisms supporting the information system security plan].