System Security and Privacy Plans

frameworkNIST SP 800-53 Rev 5.2 sectionPL Planning csf 2.0ID.AM-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 topics— frameworks3 0 0

Official texta. Develop security and privacy plans for the system that:
1. Are consistent with the organization’s enterprise architecture;
2. Explicitly define the constituent system components;
3. Describe the operational context of the system in terms of mission and business processes;
4. Identify the individuals that fulfill system roles and responsibilities;
5. Identify the information types processed, stored, and transmitted by the system;
6. Provide the security categorization of the system, including supporting rationale;
7. Describe any specific threats to the system that are of concern to the organization;
8. Provide the results of a privacy risk assessment for systems processing personally identifiable information;
9. Describe the operational environment for the system and any dependencies on or connections to other systems or system components;
10. Provide an overview of the security and privacy requirements for the system;
11. Identify any relevant control baselines or overlays, if applicable;
12. Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;
13. Include risk determinations for security and privacy architecture and design decisions;
14. Include security- and privacy-related activities affecting the system that require planning and coordination with [Assignment: organization-defined individuals or groups]; and
15. Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.
b. Distribute copies of the plans and communicate subsequent changes to the plans to [Assignment: organization-defined personnel or roles];
c. Review the plans [Assignment: organization-defined frequency];
d. Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and
e. Protect the plans from unauthorized disclosure and modification.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of PL-2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-03 ID.AM-08	Representations of the organization's authorized network communication and internal and external network data flows are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping
ISO 27001	A.5.8 A.5.34 Clause 7.5.1 Clause 7.5.2 Clause 7.5.3 Clause 10.2	Information security in project management; Privacy and protection of PII…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 13 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.11 Return of assets Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.12 Classification of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 3.8 CIS 1.2	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping +13 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
SOC 2	CC6.1 CC6.6	Logical access security over information assets; Protection against threats from outside system boundaries	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping
PCI DSS	6.3.3 12.3.4 1.2.3 1.2.4	Security patches installed promptly; Hardware and software technologies reviewed annually…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.IM-03, ID.IM-01, ID.AM-03: related, not a mapping +11 more loosely related (not mappings) 6.2.1 Bespoke and custom software developed securely Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
CMMC	CA.L2-3.12.1 CA.L2-3.12.2 CA.L2-3.12.3 CA.L2-3.12.4	Security Control Assessment; Plan of Action…	Crosswalk	NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.15.02 → SP 800-53 3 loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(B)§164.310(a)(2)(ii)§164.314(b)§164.314(b)(2)(i)§164.314(b)(2)(ii)§164.316(a)§164.316(b)§164.316(b)(2)(iii)	Risk Management; Facility Security Plan…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 12 loosely related (not mappings) §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF ID.AM-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF ID.AM-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.310(a)(2)(iv) Maintenance Records Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF ID.AM-03, ID.AM-08, ID.IM-03: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF ID.AM-03: related, not a mapping …and 4 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	12.4 4.3 6.2	Asset inventory; Crisis management…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)Art.9(4)(b)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
Cyber Essentials	CE 1 CE 3	Firewalls; Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.