Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

pl-2(3)

system security plan  | plan / coordinate with other organizational entities

assessment objective:

Determine if the organization:  

pl-2(3)[1]  

defines individuals or groups with whom security-related activities affecting the information system are to be planned and coordinated before conducting such activities in order to reduce the impact on other organizational entities; and

pl-2(3)[2]  

plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities.

potential assessment methods and objects:

Examine: [SELECT FROM: Security planning policy; access control policy; contingency planning policy; procedures addressing security-related activity planning for the information system; security plan for the information system; contingency plan for the information system; information system design documentation; other relevant documents or records].

Interview: [select from: Organizational personnel with security planning and plan implementation responsibilities; organizational individuals or groups with whom security-related activities are to be planned and coordinated; organizational personnel with information security responsibilities].