Assessing Security and Privacy Controls in Information Systems and Organizations
PL > PL-2 > Assessment Objective

PL-2 System Security and Privacy Plans - Assessment Objective
Determine if the following are satisfied:

PL-02a.01[01] a security plan for the system is developed that is consistent with the organization's enterprise architecture;
PL-02a.01[02] a privacy plan for the system is developed that is consistent with the organization's enterprise architecture;
PL-02a.02[01] a security plan for the system is developed that explicitly defines the constituent system components;
PL-02a.02[02] a privacy plan for the system is developed that explicitly defines the constituent system components;
PL-02a.03[01] a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes;
PL-02a.03[02] a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes;
PL-02a.04[01] a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;
PL-02a.04[02] a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;
PL-02a.05[01] a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;
PL-02a.05[02] a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;
PL-02a.06[01] a security plan for the system is developed that provides the security categorization of the system, including supporting rationale;
PL-02a.06[02] a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale;
PL-02a.07[01] a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization;
PL-02a.07[02] a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization;
PL-02a.08[01] a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;
PL-02a.08[02] a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;
PL-02a.09[01] a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;
PL-02a.09[02] a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;
PL-02a.10[01] a security plan for the system is developed that provides an overview of the security requirements for the system;
PL-02a.10[02] a privacy plan for the system is developed that provides an overview of the privacy requirements for the system;
PL-02a.11[01] a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;
PL-02a.11[02] a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;
PL-02a.12[01] a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions;
PL-02a.12[02] a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions;
PL-02a.13[01] a security plan for the system is developed that includes risk determinations for security architecture and design decisions;
PL-02a.13[02] a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions;
PL-02a.14[01] a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with [Assignment: organization-defined individuals or groups];
PL-02a.14[02] a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with [Assignment: organization-defined individuals or groups];
PL-02a.15[01] a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation;
PL-02a.15[02] a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
PL-02b.[01] copies of the plans are distributed to [Assignment: organization-defined personnel or roles];
PL-02b.[02] subsequent changes to the plans are communicated to [Assignment: organization-defined personnel or roles];
PL-02c. plans are reviewed [Assignment: organization-defined frequency];
PL-02d.[01] plans are updated to address changes to the system and environment of operations;
PL-02d.[02] plans are updated to address problems identified during the plan implementation;
PL-02d.[03] plans are updated to address problems identified during control assessments;
PL-02e.[01] plans are protected from unauthorized disclosure;
PL-02e.[02] plans are protected from unauthorized modification.