Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > Control Implementation Details

Control Implementation Details

Discussion: Provide implementation details for each control that is selected and
allocated to the system. Maintaining accurate control implementation details
throughout the system life cycle supports ongoing assessment and continuous
monitoring activities that evaluate the effectiveness of the control implementation.
As explained in [SP800-53], controls are outcome-based and "are selected and
implemented by the organization in order to satisfy the system requirements." The
implementation details reflect how requirement outcomes are achieved, rather than
restating the control statement as a requirement. System-specific implementation
details or common control implementation details for a common control plan indicate
how to address risk management requirements based on the "as-implemented" state of
the control, including:
• Information that addresses basic questions (i.e., who, what, where, when, why, and
how) about security, privacy, and supply chain risk management requirements
o Roles or specific entities that are responsible for control implementation,
including information about shared responsibilities for hybrid controls
o Components, products, or services associated with the control
o Results of tailoring activities and tailoring decisions
o Planned inputs, related data sources, and expected system outputs for controls
that are implemented in the hardware, software, or firmware components of the
system
o Considerations for additional technical objectives (i.e., continuous
integration/continuous delivery, zero trust architecture, artificial intelligence and
machine learning) addressed by the control implementation
o Reliance on automation for control monitoring, including performance
thresholds defined for the implementation that can be evaluated using
automation, or a combination of manual and automated methods
• Rationale and approval for tailoring associated with the control (see Sec. 4.3.1)
• Location of policy and procedure artifacts associated with the implementation
o Reference sections of operational procedures rather than including the
procedures in the system plan.
o Identify sources of information relevant to the control, such as network
monitoring tools, vulnerability scanning tools, endpoint management tools, and
GRC, SOAR, and SIEM tools.
• Description of metrics that are collected and analyzed to monitor the control
implementation, including the baseline and threshold definitions used to evaluate
control conformance to implementation procedures and parameters
• Inherited risks from the common control implementations
• Control assessment status (i.e., satisfied, other than satisfied)
o Automation can provide the ability to include the assessment history, including
the results of control monitoring activities.
o Reference plans of action and milestones (POA&Ms), remediation, and retest
artifacts for controls that are identified as "other than satisfied."
To address the inheritance of controls from common control providers, the control
implementation details in the system plan may:
• Include a reference to common controls inherited by the system
o Implementation details for common controls are provided in the artifacts
developed by common control providers that are made available to system
owners.
o Controls that are inherited from cloud service providers may require additional
documentation, such as the Control Implementation Summary/Customer
Responsibility Matrix (CIS/CRM), which conveys the control implementation
responsibilities between the cloud service provider and their customer.
• Provide system-specific implementation details for hybrid controls with
considerations for:
o Which parts of the control are provided by the common control provider or are
implemented at the system level
o How the associated security, privacy, and cybersecurity supply chain risks are
shared between the system and the common control provider
Control implementation details in the C-SCRM plan reflect the mitigation of
cybersecurity risks throughout the supply chain. [SP800-161] Appendix A, C-SCRM
Security Controls, discusses the application of C-SCRM controls, requiring controls to
flow down through key suppliers, and controls for monitoring adherence with
organizational supply chain requirements. Implementation details for C-SCRM controls
reference applicable organizational and mission/business process policies that provide
inherited controls or are issued by the chief information officer (CIO), senior
accountable official for risk management, C-SCRM PMO, or senior procurement
executive.
Control implementation details in a system privacy plan differ from those in system
security and C-SCRM plans in several ways, including:
• Scope and focus: While the system security plan primarily addresses safeguarding
the system against unauthorized access and ensuring data confidentiality, integrity,
and availability, the system privacy plan focuses on the broader implications of data
processing. This includes considerations such as the context of data use, the
potential impact on individuals, and adherence to privacy principles (e.g.,
transparency, data minimization, purpose specification). In this way, privacy controls
may address more foundational data handling and data governance in pursuit of
privacy objectives.
• Privacy-specific risks: The system privacy plan addresses privacy-specific risks that
might arise, even from authorized data processing activities. For example, privacy
controls might include measures to minimize data collection to only what is
necessary, restrict data sharing with third parties, or implement mechanisms that
allow individuals to exercise their rights over their personal data. The system privacy
plan may address privacy-specific risks that may arise from cybersecurity or C-SCRM
controls, such as monitoring for insider threats.
• Individual autonomy and transparency: Privacy controls often emphasize giving
individuals control over their data (i.e., autonomy) and ensuring that individuals are
informed about how their data is processed (i.e., transparency). These aspects may
require different implementations compared to security controls, which are
primarily concerned with protecting systems and information rather than
individuals.
Related plan elements: Control Implementation Status, Control Assessment Status