# Information Security Program Plan

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/plans/information-security-program-plan/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** PM-1 requires an organization-wide information security program plan that gives an overview of the program's requirements, describes the program management and common controls that meet them, assigns roles, and is approved by a senior official. NIST publishes no outline for this plan, so the sections below follow the elements of PM-1a in order, and each cites the item it meets. The plan can be one document or a set of documents, as long as this plan names the set. It describes how the organization defends itself, so restrict access to it (PM-1c).

| Organization | Plan version | Approved by | Approval date | Next review |
| --- | --- | --- | --- | --- |
| [Organization name] | [Fill in: version] | [Senior leader] | [Fill in: date] | [Fill in: date] |

## 1. Purpose and scope

This plan describes [Organization name]'s information security program: the requirements it meets, the program management and common controls that meet them, and who is responsible for each (PM-1a.1).

It applies to all of [Organization name]: [Fill in: the organizational units, locations and mission and business functions the program covers]. The systems in scope are listed in the system inventory (PM-5).

## 2. Program requirements

> **Guidance:** List the sources of requirements, not the requirements themselves. The policies and the system security plans carry the detail. Name the SP 800-53 baselines your systems use, so readers know which controls the common controls must support.

| Source | What it requires of the program | Owner |
| --- | --- | --- |
| [Fill in: law, regulation, contract or standard] | [Fill in: summary] | [Fill in: role] |
| NIST SP 800-53 Rev. 5 and SP 800-53B | Controls for each system at its baseline: [Fill in: baselines in use, for example Low and Moderate] | [Chief Information Security Officer] |
| [Organization name] security policies | The family policies adopted by the organization, listed in section 8 | [Chief Information Security Officer] |

## 3. Roles and responsibilities

> **Guidance:** Name roles, not people, in the plan, and keep the names of the people currently in each role in an appendix or a separate roster. Assessors check that each role in PM-2, PM-10, PM-19 and PM-29 is filled and that its appointment is recorded in writing.

| Role | Responsibilities | Appointed by | Held by |
| --- | --- | --- | --- |
| [Senior leader] | Approves this plan and the risk management strategy; sets risk tolerance; provides resources (PM-1a.4, PM-3) | Governing body | [Fill in: title of the person in the role] |
| [Chief Information Security Officer] | Leads the information security program; owns this plan (PM-2) | [Senior leader] | [Fill in: title] |
| [Senior privacy official] | Leads the privacy program and its plan (PM-18, PM-19) | [Senior leader] | [Fill in: title] |
| Senior accountable official for risk management | Aligns security and privacy processes with strategic, operational and budget planning (PM-29a) | [Senior leader] | [Fill in: title] |
| Risk executive (function) | Views risk across the organization and keeps risk decisions consistent (PM-29b) | [Senior leader] | [Fill in: members] |
| Authorizing officials | Accept risk for the systems they authorize (PM-10b) | [Senior leader] | [Fill in: titles, and the systems each authorizes] |
| [System owner] | Implements controls for the system and maintains its security plan | [Fill in: who appoints system owners] | Named in each system security plan |
| Common control providers | Implement and maintain the common controls in section 7 | [Chief Information Security Officer] | [Fill in: teams] |
| [Security operations team] | Monitors, analyzes and reports security events | [Chief Information Security Officer] | [Fill in: team or provider] |
| [Incident response team] | Handles incidents under the incident response plan | [Chief Information Security Officer] | [Fill in: team and lead] |

These roles are identified and assigned by this plan (PM-1a.2).

## 4. Management commitment and resources

The [Senior leader] commits to the program by approving this plan and by providing the resources in the table below (PM-1a.2). Security and privacy resources are included in each capital planning and investment request (PM-3a).

| Resource | Current period | Planned next period |
| --- | --- | --- |
| Security staff (full-time equivalents) | [Fill in: number] | [Fill in: number] |
| Privacy staff (full-time equivalents) | [Fill in: number] | [Fill in: number] |
| Budget for security tools and services | [Fill in: amount] | [Fill in: amount] |
| External services (for example assessment, monitoring, incident response retainer) | [Fill in: services] | [Fill in: services] |

## 5. Coordination

The program is coordinated with the organizational entities below (PM-1a.3).

| Entity | What is coordinated | How and how often |
| --- | --- | --- |
| Privacy office | Privacy risk, privacy controls, breach response | [Fill in: for example monthly meeting and shared plan of action and milestones] |
| Legal | Laws, contracts, notification obligations | [Fill in: how] |
| Human resources | Screening, onboarding, transfers, departures, sanctions | [Fill in: how] |
| Procurement | Security requirements in acquisitions, supplier risk | [Fill in: how] |
| Finance | Security and privacy resources in budgets | [Fill in: how] |
| Physical security | Facility access and protection | [Fill in: how] |
| Mission and business owners | Risk tolerance, system priorities, continuity | [Fill in: how] |

## 6. Compliance and performance

- Compliance with the security policies is checked through control assessments and continuous monitoring, following the continuous monitoring strategy (PM-31).
- Exceptions to policy are requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with compensating measures in [Fill in: where exceptions are recorded].
- Violations are handled through the organization's sanctions process.
- The program reports these measures of performance to the [Senior leader] [Fill in: how often, for example quarterly] (PM-6):

| Measure | Target | Source of data |
| --- | --- | --- |
| Systems with a current authorization | [Fill in: target, for example 100%] | System inventory |
| Plan of action and milestones items past their due date | [Fill in: target] | Plans of action and milestones |
| Vulnerabilities remediated within the required times | [Fill in: target] | Vulnerability scanning |
| Personnel with current security awareness training | [Fill in: target] | Training records |
| [Fill in: other measure] | [Fill in: target] | [Fill in: source] |

These arrangements describe how compliance is achieved (PM-1a.2).

## 7. Program management and common controls

> **Guidance:** This is the heart of the plan for an assessor. List every program management control with how it is met, then every common control that systems inherit. A system security plan can then mark those controls as inherited from this plan, and its assessors test them once here. Mark planned controls with a target date.

### Program management controls

The program management controls, their status and where each is carried out (PM-1a.1):

| Control | Title | Status | How it is met | Owner |
| --- | --- | --- | --- | --- |
| PM-1 | Information Security Program Plan | [Fill in: in place or planned] | This plan | [Chief Information Security Officer] |
| PM-2 | Information Security Program Leadership Role | [Fill in: status] | [Fill in: appointment record] | [Senior leader] |
| PM-3 | Information Security and Privacy Resources | [Fill in: status] | Section 4 | [Senior leader] |
| PM-4 | Plan of Action and Milestones Process | [Fill in: status] | [Fill in: process and tool] | [Chief Information Security Officer] |
| PM-5 | System Inventory | [Fill in: status] | [Fill in: where the inventory is kept] | [Chief Information Security Officer] |
| PM-6 | Measures of Performance | [Fill in: status] | Section 6 | [Chief Information Security Officer] |
| PM-7 | Enterprise Architecture | [Fill in: status] | [Fill in: document] | [Fill in: owner] |
| PM-8 | Critical Infrastructure Plan | [Fill in: status, or not applicable and why] | [Fill in: document] | [Fill in: owner] |
| PM-9 | Risk Management Strategy | [Fill in: status] | Risk management strategy, listed in section 8 | [Chief Information Security Officer] |
| PM-10 | Authorization Process | [Fill in: status] | [Fill in: procedure] | [Chief Information Security Officer] |
| PM-11 | Mission and Business Process Definition | [Fill in: status] | [Fill in: document] | [Senior leader] |
| PM-12 | Insider Threat Program | [Fill in: status] | [Fill in: program charter] | [Chief Information Security Officer] |
| PM-13 | Security and Privacy Workforce | [Fill in: status] | [Fill in: program] | [Chief Information Security Officer] |
| PM-14 | Testing, Training, and Monitoring | [Fill in: status] | [Fill in: plans] | [Chief Information Security Officer] |
| PM-15 | Security and Privacy Groups and Associations | [Fill in: status] | [Fill in: groups] | [Chief Information Security Officer] |
| PM-16 | Threat Awareness Program | [Fill in: status] | [Fill in: program and sharing partners] | [Chief Information Security Officer] |
| PM-17 | Protecting Controlled Unclassified Information on External Systems | [Fill in: status, or not applicable and why] | [Fill in: policy and procedures] | [Chief Information Security Officer] |
| PM-18 to PM-27 | Privacy program controls | [Fill in: status] | Privacy program plan | [Senior privacy official] |
| PM-28 | Risk Framing | [Fill in: status] | Risk management strategy | [Chief Information Security Officer] |
| PM-29 | Risk Management Program Leadership Roles | [Fill in: status] | Section 3 | [Senior leader] |
| PM-30 | Supply Chain Risk Management Strategy | [Fill in: status] | [Fill in: document] | [Chief Information Security Officer] |
| PM-31 | Continuous Monitoring Strategy | [Fill in: status] | [Fill in: document] | [Chief Information Security Officer] |
| PM-32 | Purposing | [Fill in: status] | [Fill in: analysis] | [Chief Information Security Officer] |

### Common controls

Controls that the organization provides once and systems inherit, fully or in part (PM-1a.1):

| Control | Common control provider | Inherited by | Fully or partly | Status | Where documented |
| --- | --- | --- | --- | --- | --- |
| [Fill in: for example AT-2] | [Fill in: for example the security awareness team] | [Fill in: all systems, or named systems] | [Fill in: fully or partly] | [Fill in: in place or planned, with date] | [Fill in: document or record] |

## 8. Related plans, strategies and policies

| Document | Control | Location | Last approved |
| --- | --- | --- | --- |
| Risk management strategy | PM-9 | [Fill in: location] | [Fill in: date] |
| Privacy program plan | PM-18 | [Fill in: location] | [Fill in: date] |
| Supply chain risk management strategy | PM-30 | [Fill in: location] | [Fill in: date] |
| Continuous monitoring strategy | PM-31 | [Fill in: location] | [Fill in: date] |
| Family policies | The -1 control of each family | [Fill in: location] | [Fill in: date] |
| Incident response plan | IR-8 | [Fill in: location] | [Fill in: date] |

## 9. Approval

The [Senior leader] approves this plan as the senior official responsible and accountable for the risk that [Organization name] incurs to its operations, assets, individuals, other organizations and the Nation (PM-1a.4).

| Name | Title | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [Senior leader] | | [Fill in: date] |

## 10. Review, change history and protection

- The [Chief Information Security Officer] shall review and update this plan [Fill in: the frequency at which to review and update the organization-wide information security program plan. Typical: annually] and following [Fill in: events that trigger the review and update of the organization-wide information security program plan. Typical: a significant change to the organization's mission, structure, risk tolerance or systems, a major incident, or a finding from an assessment or audit of the program]. (PM-1b)
- The [Chief Information Security Officer] shall protect this plan from unauthorized disclosure and modification by keeping it in [Fill in: where the plan is kept, with access limited to named roles] and keeping each approved version. (PM-1c)

| Version | Date | Change | Approved by |
| --- | --- | --- | --- |
| [Fill in: version] | [Fill in: date] | [Fill in: summary of change] | [Fill in: name and title] |

### Federal systems

For federal agencies, this plan documents the agency-wide information security program required by the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554(b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)). The [Chief Information Security Officer] is the senior agency information security officer designated under 44 U.S.C. § 3554(a)(3)(A), and the [Senior privacy official] is the Senior Agency Official for Privacy designated under [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf).

- Section 2 shall list the federal laws, OMB policies and CISA directives that apply to the agency's systems. (PM-1a.1)