ezesecops/rmf-ato-core huggingface dataset:
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Categorization

System Categorization

Discussion: Assign the security category according to the security impact levels (i.e., low,
moderate, and high) associated with the information types processed, stored, and
transmitted by the system following the guidelines in [SP800-60v1]. The security
category is a key factor when selecting a [SP800-53B] security baseline as the starting
point for the selection of controls.
Impact levels are based on risk management activities, system artifacts (e.g., Risk
Assessment Report, PIA, SORN), guidelines on the categorization of federal information
and systems [FIPS199], and justifications for adjusting the [SP800-60v2] provisional
impact levels. Special conditions may be applied to the provisional impact levels for
each information type. The high-water mark for each of the security impacts determines
the final system category.
Related plan elements: System Information Types
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Information Types

System Information Types

Discussion: Identify the [SP800-60v2] information types processed, stored, and
transmitted by the system. Understanding the information types handled by the system
and the information life cycle for each information type across all stages of the system
life cycle can assist the system owner in recognizing where security and privacy risks
could arise, identifying considerations for protecting the information, and applying
controls where they can be most effective.
The types of information handled by the system in support of organizational
mission/business functions and processes are key to determining the system security
category and the initial selection of controls.
Related plan elements: System Categorization
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Name and Identifier

3.2. System Plan Element Details

This section provides a discussion of each of the system plan elements identified in Table 1.

System Name and Identifier

Discussion: Designate a unique system name and identifier to distinguish one system
from another in organizational records. Organizations determine the method for
assigning the system name, an associated acronym, and a unique system identifier for
all systems in the organization's inventory based on the implementation of [SP800-53]
PM-05, System Inventory. The system identifier may be automatically generated or
manually assigned using organization-defined conventions.
The system name and identifier remain the same throughout the system life cycle to
facilitate the management and tracking of system components, artifacts, assessment
and monitoring reports, and risk-based decisions, as well as the traceability of responses
to privacy and security events (e.g., access to data, data transfers). Where possible, the
system name and identifier are referenced in PIAs and PRAs to link privacy risks to
specific systems and their associated controls.
For a complex system (see [SP800-37] Appendix G, Authorization Boundary
Considerations), additional subsystem or system element identifiers may be assigned to
reflect the relationship between the authorization boundary and the individual
subsystems within the environment of operation.
Related plan elements: System Type, System Overview
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Operational Status

Related plan elements: Remediation Actions

System Operational Status

Discussion: Identify the readiness of the system and related subsystems within the
environment of operation. Common status indicators include:
• Under development: The system is being designed or developed and is not fully
functioning in an operational environment.
• Operational: The authorized system is operating in the operational environment.
• Undergoing a significant modification: The authorized operational system is
undergoing a significant change to the operational environment that is likely to
substantively affect the security, privacy, or supply chain posture of a system.
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Overview

System Overview

Discussion: Provide a brief overview of the mission/business functions of the system
and the purpose of the system (e.g., economic indicator, network support for an agency,
business census data analysis, crop reporting support).The overview may highlight risk
management strategies for high-risk aspects of the environment of operation, such as
high-availability components or public-facing services.
Summarize the data and information types handled by the system (e.g., CUI, privacy).
Highlight the relationship between the system owner and data owner responsibilities
for data collection, processing, and disposal as provided from the organization or system
data governance strategy. In the privacy plan, the overview aligns with the information
provided in the PIA, PRA, and other applicable privacy documentation (e.g., notices to
the public, information exchange agreements).
Compile a list of the technologies being used to support the mission/business functions
and factors that present additional security- or privacy-specific risks, such as cloud-
based products and services, "bring your own device" (BYOD) policies, or the processing
of data about individuals. Reference key design considerations (e.g., centralization
methods, continuous integration and continuous delivery, zero trust architecture,
emerging technologies) in the approach for identifying and managing system risks.
Identify the system user base and user roles that require privileged access to specific
components, enclaves, or data flows that contain data about individuals to ensure
accountability and transparency.
Summarize the system's supply chain profile and highlight C-SCRM-relevant
technologies (e.g., foreign-sourced components, vendor-managed services,
TAA/Common Criteria/NIAP compliance or open-source dependencies) to support a
holistic understanding of system risks and to ensure alignment of security, privacy, and
C-SCRM risk management.
Related plan elements: System Type, System Information Types, Authorization
Boundary Description
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Plan Approval

System Plan Approval

Discussion: System plan approval is critical prior to control implementation for systems
under development. By approving the system plans before the system is in operation,
the authorizing official or designated representative accepts and agrees to the allocated
set of controls, the proposed implementation of the allocated controls, and the
inheritance of controls from common control provider plans. Input from other
organizational officials provides information to support the approval of system plans.
For example:
• System security plan approval includes concurrence between the system owner and
the senior accountable official for risk management or risk executive (function), CIO,
or senior agency information security officer.
• System privacy plan approval includes concurrence between the system owner and
the senior agency official for privacy to demonstrate alignment between the
organization's privacy and security programs.
• C-SCRM plan approval includes coordination with the C-SCRM PMO.
System plan approval includes the full names, system roles, organizational titles,
signatures, and signature dates of the individuals who approved the plan. Information
management tools and document management systems can electronically capture the
required signatures from the appropriate approvers.
The system owner or common control provider is responsible for updates to the system
plan. System plan reviews and change records, along with the subsequent
reauthorization or ongoing authorization of the system, ensure that updates to the
system plan based on the "as-implemented" state of the controls are reviewed and
approved [SP800-37] by the authorizing official.
Approval of the system plans does not authorize the operation of the system or the
offering of common controls for inheritance.
Related plan elements: System Plan Review Records, System Plan Change Records
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Plan Change Records

System Plan Change Records

Discussion: A system plan change record focuses on specific updates that are made to
the system plan. Updates to the system plan are often the result of changes to the
system that are approved and applied as part of organization- or system-specific change
management processes implemented as part of [SP800-53] CM-03, Configuration
Change Control. A system plan change record can include the following information:
• Date of revision
• Plan revision identifier
• Identity of individual making the system plan change
• The system plan elements affected (e.g., control implementation details,
authorization boundary description, information exchange summary)
• Details of the plan changes (e.g., controls affected, role assignment changes,
updated links to referenced artifacts)
The records help management understand the content updates that have been
implemented and verify that the authorization package contains the most current
revision of the system plans. While document management processes may require
manual change record updates, information management tools (e.g., IT service desk
solutions, ticketing systems) can automatically track changes made to specific system
plan elements. Organizational and system managers can generate reports that identify
the users who approved and implemented individual changes to the system plans.
Related plan elements: System Plan Approval, Control Implementation Details,
Remediation Actions
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Plan Review Records

System Plan Review Records

Discussion: System plan reviews ensure accountability for periodic (e.g., life cycle
milestones, gate reviews, significant contracting activities) and ad hoc changes.
Organization-designated individuals can verify the accuracy and completeness of the
information in the system plans and alignment between system plans.
A system plan review log records the name and role of the individual performing the
review, the review date, the feedback generated during the review process, and
associated notes. The review record may include additional information, such as:
• Dates of review
• Review Participants
• Notable outcomes (i.e., recommended revisions, concerns, other action items)
Updates to the system plan are approved and applied as part of organizational or
system-specific change management processes. The records help management
understand the content updates that have been implemented and verify that the
authorization package contains the most current revision of the system plans.
Related plan elements: System Plan Approval, Control Implementation Status, Control
Assessment Status
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Type

System Type

Discussion: Identify key characteristics that define the type of system, such as:
• Common control provider (e.g., data center facility, enterprise architecture services)
• Implemented or supported technology (e.g., operational technology, cloud-based
system, cloud-supported application, artificial intelligence system, high-performance
computing)
• Environment Type (e.g., development, testing, training, production)
• System exposure (e.g., restricted access, public-facing system, physically or logically
isolated)
• System criticality11 (e.g., organization-critical, mission-critical, high-availability, low-
priority)
• Ownership of the system (e.g., federal information system; government-owned,
contractor-supported system; contractor-owned and operated system)
11 [IR8179] Discusses the system/subsystem- and component/subcomponent-level criticality analysis based on their importance to the goals of
an organization and the impact that their loss may present to those goals.
• Function of the system (e.g., transaction processing, operational management,
decision support, customer relationship management, science data processing,
machine learning)
The terms "general support system," "major application," and "minor application" for
system types have been deprecated for federal information systems following
[OMBA-130] requirements. This change reflects shifts in technology away from
perimeter-based security and toward risk-based requirements for holistically protecting
systems and system data, including the system infrastructure and applications within
the infrastructure.
The system type is distinct from the system information types used to assign the
security categorization of the system.
Related plan elements: System Overview, Authorization Boundary Description
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK A-5

TASK A-5

Remediation Actions
Initial remediation actions completed based on
assessment reports; changes to implementations
reassessed by the assessment team; updated
assessment reports; updated system plans, including
changes to control implementations.
•
Control Implementation Details
•
Control Assessment Status
•
Remediation Actions
•
System Authorization Decision
•
System Plan Change Records
Assess
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK A-6

TASK A-6

Plan of Action and Milestones
A plan of action and milestones detailing the findings
from the security and privacy assessment reports that
are to be remediated.
•
Control Assessment Status
•
Remediation Actions
•
System Plan Change Records
Authorize
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK C-2

TASK P-18

System Registration
Registered system in accordance with organizational
policy.
•
System Name and Identifier
Categorize

TASK C-1

System Description
Documented system description.
•
System Overview
•
System Information Types
•
System Operational Status
Categorize

TASK C-2

Security Categorization
Impact levels determined for each information type
and for each security objective (confidentiality,
integrity, availability); security categorization based on
high-water mark of information type impact levels.
•
System Categorization
Categorize
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK I-2

TASK S-3

Control Allocation
List of security and privacy controls that are allocated
to the system, system elements, and environment of
operation.
•
Control Implementation Details
Select

TASK S-4

Documentation of Planned
Control Implementations
Security, privacy, and C-SCRM plans for the system.
•
Control Implementation Details
•
Control Implementation Status
Select

TASK S-5

Continuous Monitoring
Strategy - System
Continuous monitoring strategy for the system,
including a time-based trigger for ongoing
authorization.
•
Control Implementation Details
Select

TASK S-6

Plan Review and Approval
System plans approved by the authorizing official.
•
System Plan Approval
Implement

TASK I-1

Control Implementation
Implemented controls.
•
Control Implementation Details
•
Information Exchanges Summary
Implement

TASK I-2

Update Control
Implementation Information
System plans updated with implementation detail
sufficient for use by assessors; system configuration
baseline.
•
Control Implementation Details
•
Control Implementation Status
•
Information Exchanges Summary
•
Remediation Actions
•
System Plan Change Records
Assess
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK M-1

TASK M-1

System and Environment
Changes
Updated system plans; updated plans of action and
milestones; updated assessment reports.
•
System Overview
•
Authorization Boundary Description
•
Environment of Operation Diagrams
•
Control Implementation Details
•
Information Exchanges Summary
•
System Operational Status
•
System Plan Change Records
Monitor
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK M-3

TASK M-2

Ongoing Assessments
Updated assessment reports; updated supplier
assessments.
•
Control Assessment Status
Monitor

TASK M-3

Ongoing Risk Response
Mitigation actions or risk acceptance decisions;
updated assessment reports.
•
Control Implementation Details
•
Information Exchanges Summary
•
Remediation Actions
•
System Plan Change Records
C-SCRM Plans for Systems for Systems
RMF Step
RMF Task
RMF Task Expected Outputs [SP 800-37r2]
System Plan Elements
Monitor
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK M-4

TASK M-4

Authorization Package Updates
Updated assessment reports; updated plans of action
and milestones; updated risk assessment results;
updated system plans.
•
Remediation Actions
•
System Authorization Decision
•
System Plan Review Records
•
System Plan Change Records
•
Digital Identity Acceptance Statement (DIAS)
(optional)
Monitor
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK M-6

TASK M-6

Ongoing Authorization
A determination of risk; ongoing authorization to
operate, ongoing authorization to use, ongoing
common control authorization; denial of ongoing
authorization to operate, denial of ongoing
authorization to use, denial of ongoing common
control authorization.
•
System Authorization Decision
Monitor
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK P-12

TASK P-8

Mission or Business Focus
Missions, business functions, and mission/business
processes that the system will support.
•
System Overview
•
System Type
Prepare -
System Level

TASK P-9

System Stakeholders
List of system stakeholders.
•
Role Identification and Responsible Personnel
Prepare -
System Level

TASK P-10

Asset Identification
Set of assets to be protected.
•
Authorization Boundary Description
•
System Component Inventory
•
Environment of Operation Diagrams
Prepare -
System Level

TASK P-11

Authorization Boundary
Documented authorization boundary.
•
Authorization Boundary Description
•
Environment of Operation Diagrams
Prepare -
System Level

TASK P-12

Information Types
A list of information types for the system.
•
System Information Types
C-SCRM Plans for Systems for Systems
RMF Step
RMF Task
RMF Task Expected Outputs [SP 800-37r2]
System Plan Elements
Prepare -
System Level
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK P-13

TASK P-13

Information Life Cycle
Documentation of the stages through which
information passes in the system, such as a data map
or model illustrating how information is structured or
processed by the system throughout its life cycle. Such
documentation may include data flow diagrams, entity
relationship diagrams, database schemas, and data
dictionaries.
•
System Information Types
•
Authorization Boundary Description
•
Environment of Operation Diagrams
•
Information Exchanges Summary
Prepare -
System Level
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK P-16

TASK P-15

Requirements Definition
Documented security, privacy, and C-SCRM
requirements.
•
Laws, Regulations, and Policies Affecting the
System
Prepare -
System Level

TASK P-16

Enterprise Architecture
Updated enterprise architecture; updated security
architecture; updated privacy architecture; plans to
use cloud-based systems and shared systems, services,
or applications.
•
Authorization Boundary Description
•
Environment of Operation Diagrams
Prepare -
System Level
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK P-17

TASK P-17

Requirements Allocation
List of security, privacy, and C-SCRM requirements for
the system, system elements, and environment of
operation.
•
Laws, Regulations, and Policies Affecting the
System
Prepare -
System Level
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK P-4

TASK P-4

Organizationally-Tailored
Control Baselines and
Cybersecurity Framework
Profiles (Optional)
List of approved or directed organizationally tailored
control baselines.
•
Control Implementation Details
Prepare -
Organization
Level
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK P-5

TASK P-5

Common Control Identification
List of common control providers and common
controls available for inheritance; security and privacy
plans (or equivalent documents) that provide a
description of the common control implementation
(including inputs, expected behavior, and expected
outputs).
•
Control Implementation Details
Prepare -
System Level
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK R-1

TASK R-1

Authorization Package
Authorization package (with an executive summary),
which may be generated from a security or privacy
management tool for submission to the authorizing
official.
•
Remediation Actions
•
Digital Identity Acceptance Statement (DIAS)
(optional)
C-SCRM Plans for Systems for Systems
RMF Step
RMF Task
RMF Task Expected Outputs [SP 800-37r2]
System Plan Elements
Authorize
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK R-4

TASK R-2

Risk Analysis and
Determination
Risk determination.
•
System Authorization Decision
Authorize

TASK R-3

Risk Response
Risk responses for determined risks.
•
Control Implementation Details
•
Information Exchanges Summary
•
Remediation Actions
•
System Plan Change Records
Authorize

TASK R-4

Authorization Decision
Authorization to operate, authorization to use,
common control authorization; denial of authorization
to operate, denial of authorization to use, denial of
common control authorization.
•
System Authorization Decision
Monitor
Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Appendix A. RMF Task Outputs Related to System Plan Elements > TASK S-2

TASK C-3

Security Categorization Review
and Approval
Approval of security categorization for the system.
•
System Categorization
Select

TASK S-1

Control Selection
Controls selected for the system and the environment
of operation.
•
Control Implementation Details
Select

TASK S-2

Control Tailoring
List of tailored controls for the system and
environment of operation (i.e., tailored control
baselines).
•
Control Implementation Details
C-SCRM Plans for Systems for Systems
RMF Step
RMF Task
RMF Task Expected Outputs [SP 800-37r2]
System Plan Elements
Select