PL-11 Baseline Tailoring

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: PL-10, RA-2, RA-3, RA-9, SA-8

Control statement

Tailor the selected control baseline by applying specified tailoring actions.

NIST discussion

The concept of tailoring allows organizations to specialize or customize a set of baseline controls by applying a defined set of tailoring actions. Tailoring actions facilitate such specialization and customization by allowing organizations to develop security and privacy plans that reflect their specific mission and business functions, the environments where their systems operate, the threats and vulnerabilities that can affect their systems, and any other conditions or situations that can impact their mission or business success. Tailoring guidance is provided in SP 800-53B . Tailoring a control baseline is accomplished by identifying and designating common controls, applying scoping considerations, selecting compensating controls, assigning values to control parameters, supplementing the control baseline with additional controls as needed, and providing information for control implementation. The general tailoring actions in SP 800-53B can be supplemented with additional actions based on the needs of organizations. Tailoring actions can be applied to the baselines in SP 800-53B in accordance with the security and privacy requirements from FISMA, PRIVACT , and OMB A-130 . Alternatively, other communities of interest adopting different control baselines can apply the tailoring actions in SP 800-53B to specialize or customize the controls that represent the specific needs and concerns of those entities.

Assessment objectives (SP 800-53A)

Objectives and methods for PL-11

Determine if the selected control baseline is tailored by applying specified tailoring actions.

Examine: Security and privacy planning policy; procedures addressing system security and privacy plan development and implementation; system design documentation; system categorization decision; information types stored, transmitted, and processed by the system; system element/component information; stakeholder needs analysis; list of security and privacy requirements allocated to the system, system elements, and environment of operation; list of contractual requirements allocated to external providers of the system or system element; business impact analysis or criticality analysis; risk assessments; risk management strategy; organizational security and privacy policy; federal or organization-approved or mandated baselines or overlays; baseline tailoring rationale; system security plan; privacy plan; records of system security and privacy plan reviews and updates; other relevant documents or records.

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities; organizational personnel with information security and privacy responsibilities.

Policy statement

• Each System owner shall tailor the selected control baseline by applying specified tailoring actions. (PL-11)
• The System owner shall document each tailoring decision, with its rationale, in the system security plan, and have the authorizing official approve it with the plan. (PL-11)

From the Planning Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PL-11 asks you to tailor the selected baseline to the system. SP 800-53B section 2.4 lists the tailoring actions, which NIST’s PL-11 discussion and SP 800-37 Rev. 2 task S-2 repeat:

• Identify and designate common controls.
• Apply scoping considerations.
• Select compensating controls.
• Assign values to organization-defined parameters.
• Supplement the baseline with more controls.
• Provide specification information for implementation.

Common implementations. Account for every control in the baseline in section 10 of the system security plan, and record each tailoring decision with its rationale (PL-2a.12). SP 800-53B section 2.4 says organizations “do not arbitrarily remove” controls, and each decision should be defensible on mission needs, a sound rationale and explicit risk-based determinations. The rules it sets for each action:

• Common controls: list the controls inherited from a named provider. The system owner and authorizing official still decide whether each gives enough protection; the Information Security Program Plan lists the organization’s common controls.
• Scoping: a control applies only to the components that provide or support its function. It may not apply where its technology is absent, such as wireless. Controls that support only one objective can be downgraded to the lower baseline when that objective is rated lower. For example, a system that is moderate for confidentiality but low for availability may leave out CP-2(1).
• Compensating controls: select them from SP 800-53 where possible, explain how each gives equivalent protection and why the baseline control cannot be implemented, and assess and accept the risk.
• Parameters: set every value, usually from the family policies and their decision worksheets; the values become part of the control.
• Supplementing: add controls where the baseline’s assumptions do not hold, for example insider or advanced persistent threats, or information that law or policy says needs special protection.

Controls that meet laws, regulations or policies are not tailored out. Apply any overlay the authorizing official requires; SP 800-53B Appendix C describes overlays for communities of interest, technologies and sectors. NIST’s own SP 800-234 (May 2026), a high-performance computing security overlay, is built on the Moderate baseline and tailors 60 controls.

Organization-defined parameters. PL-11 has none. In the Planning policy, the system owner tailors the selected baseline, documents each decision with its rationale in the security plan, and has the authorizing official approve it with the plan. The authorizing official can set limits on tailoring when approving the categorization (SP 800-37 task C-3).

Evidence assessors ask for.

• The security plan’s tailoring section, with a rationale for every control removed, marked not applicable or downgraded
• The rationale and risk acceptance for each compensating control
• Every parameter value set, with its source
• The list of inherited common controls, with the provider and its assessment results
• The authorizing official’s approval of the plan, including the tailoring

Inheritance. The organization often provides tailored baselines, overlays, parameter values and the common control list (PM family). Tailoring for the system is system-specific.

Common findings.

• Controls marked “not applicable” with no rationale, or with a rationale that does not match the system.
• Controls tailored out that a law, regulation or policy requires.
• Compensating controls with no explanation of equivalent protection, or no risk acceptance.
• Blank or “to be determined” parameter values.
• Common controls claimed with no provider named, or a provider whose assessment is out of date.
• Tailoring not revisited when the system or its threats changed.

Enhancements in the Moderate baseline. PL-11 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix I, section 5.d, requires agencies to tailor the baselines and to “include a justification, in their information system security plans or overlays, for any tailoring actions that result in changes to the initial security control baselines.” It does not allow changes that make control selections inconsistent with federal statutes, executive orders, regulations, directives or policies. SP 800-53B section 2.4 adds that agencies tailor in accordance with OMB policy, and that OMB may prohibit tailoring specific controls.

Artifacts

• Planning Decision Worksheet
• Planning Policy