Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > 3.1. System Plan Elements Summary

3.1. System Plan Elements Summary

The system plan elements summary in Table 1 is organized based on the RMF tasks in
[SP800-37], where the system and privacy plan are identified as either potential inputs or
expected outputs for tasks. Inputs and outputs from multiple RMF tasks may be combined to
fully address some system plan element.
This structure provides a basis for the logical development and maintenance of a "living"
system plan. The system plan elements enable an organization to determine a method for
collecting and presenting information about the system, whether it is being developed or is
authorized to operate. The information collected and reported for each element accurately
communicates the efforts to safeguard the system information and components to
organizational leadership, authorizing officials, system owners, and risk managers throughout
the system life cycle.
Each system plan element in Table 1 is cross-referenced with the corresponding RMF task
outputs in Appendix A, Table 2. Section 3.2 discusses the objectives and content considerations
for each system plan element. Section 4 describes additional considerations for the RMF steps
to support those responsible for managing the development of system plans.
System plan outline examples are provided as supplemental materials to this publication and
show potential ways to combine these elements into an automated system plan report or
system plan artifact.
Table 1. System Plan Elements Summary
RMF Step
Source RMF Task(s)
System Plan Element
System Plan Element Overview
Prepare
P-18, System Registration
System Name and Identifier
Identify the system name and unique system identifier.
Prepare
P-8, Mission or Business Focus
C-1, System Description
System Type
Identify the type of system.
Prepare
P-8, Mission or Business Focus
C-1, System Description
M-1, System and Environment
Changes
System Overview
Identify the mission processes and business functions that the
system is intended to support.
Prepare
P-9, System Stakeholders
Role Identification and
Responsible Personnel
Identify the individuals who serve as authorizing officials and
system owners as well as other key roles with system
responsibilities.
Prepare
P-12, Information Types
P-13, Information Life Cycle
System Information Types
Identify the information types that are processed, stored, or
transmitted by the system.
Prepare
P-15, Requirements Definition
P-17, Requirements Allocation
Laws, Regulations, and Policies
Affecting the System
Requirements
Identify current laws, regulations, and policies that influence
organizational policies and system requirements.
Prepare
P-10, Asset Identification
P-11, Authorization Boundary
P-13, Information Life Cycle
P-16, Enterprise Architecture
M-1, System and Environment
Changes
Authorization Boundary
Description
Define the scope of the system protections that encompass the
authorization boundary, including all components and
subsystems of the system to be authorized for operation.
Prepare
P-10, Asset Identification
M-7, System Disposal
System Component Inventory
Identify the inventory of components being used within the
authorization boundary.
RMF Step
Source RMF Task(s)
System Plan Element
System Plan Element Overview
Prepare
P-10, Asset Identification
P-11, Authorization Boundary
P-13, Information Life Cycle
P-16, Enterprise Architecture
M-1, System and Environment
Changes
Environment of Operation
Diagrams
Include system diagrams that clearly depict the components of
the system architecture within the authorization boundary.
Categorize
C-2, Security Categorization
C-3, Security Categorization Review
and Approval
System Categorization
Categorize information types by their impact level for each
security objective (i.e., confidentiality, integrity, availability). The
system security category reflects the high-water mark of the
security category of all designated subsystems.
Select
P-4, Organizationally-Tailored
Control Baselines and Cybersecurity
Framework Profiles (Optional)
P-5, Common Control Identification
S-1, Control Selection
S-2, Control Tailoring
S-3, Control Allocation
S-4, Documentation of Planned
Control Implementations
S-5, Continuous Monitoring Strategy
- System
I-1, Control Implementation
I-2, Update Control Implementation
Information
A-5, Remediation Actions
R-3, Risk Response
M-1, System and Environment
Changes
M-3, Ongoing Response
Control Implementation Details
Provide implementation details for all controls that are allocated
to the system. Identify the location of artifacts that are
referenced in the control implementation details.
Select
S-6, Plan Review and Approval
System Plan Approval
Indicate whether the plan has been approved by the authorizing
official.
RMF Step
Source RMF Task(s)
System Plan Element
System Plan Element Overview
Implement
S-4, Documentation of Planned
Control Implementations
I-2, Update Control Implementation
Information
Control Implementation Status
Indicate the implementation status of the control.
Implement
P-13, Information Life Cycle
I-1, Control Implementation
I-2, Update Control Implementation
Information
R-3, Risk Response
M-1, System and Environment
Changes
M-3, Ongoing Response
Information Exchanges Summary
Summarize the flow of information exchanged with other
systems outside the authorization boundary.
Assess
A-5, Remediation Actions
A-6, Plan of Actions and Milestones
M-2, Ongoing Assessments
Control Assessment Status
Indicate the assessment status of each allocated control resulting
from the assessment process.
Assess
I-2, Update Control Implementation
Information
A-5, Remediation Actions
A-6, Plan of Action and Milestones
R-1, Authorization Package
R-3, Risk Response
M-3, Ongoing Risk Response
M-4, Authorization Package Updates
Remediation Actions
Identify controls that require remediation action resulting from
assessment results and the associated plan of action and
milestones.
Authorize
R-1, Authorization Package
M-4, Authorization Package Updates
Digital Identity Acceptance
Statement (optional)
Provide a Digital Identity Acceptance Statement (DIAS), as
described in [SP800-63-4].
Authorize
A-5, Remediation Actions
R-2, Risk Analysis and Determination
R-4, Authorization Decision
M-4, Authorization Package Updates
M-6, Ongoing Authorization
System Authorization Decision
Identify the authorization decision and the effective date and
duration of the authorization provided by the authorizing official.
RMF Step
Source RMF Task(s)
System Plan Element
System Plan Element Overview
Monitor
C-1, System Description
M-1, System and Environment
Changes
M-7, System Disposal
System Operational Status
Indicate the operational status of the system and subsystems.
Monitor
M-4, Authorization Package Updates
System Plan Review Records
Provide a method for recording system plan reviews over the
course of the system life cycle.
Monitor
I-2, Update Control Implementation
Information
A-5, Remediation Actions
A-6, Plan of Action and Milestones
R-3, Risk Response
M-1, System and Environment
Changes
M-3, Ongoing Risk Response
M-4, Authorization Package Updates
M-7, System Disposal
System Plan Change Records
Provide a method for recording system plan changes over the
course of the system life cycle.