# Planning Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/pl/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet PL-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PL-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Planning, and who is accountable for meeting those requirements. (PL-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PL-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (PL-1a.1(a))
- The [Fill in: an official to manage the planning policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (PL-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (PL-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (PL-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (PL-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PL-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (PL-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (PL-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (PL-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (PL-1a.1(a))

## Procedures

The [Fill in: an official to manage the planning policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (PL-1a.2)

## Dissemination

- The [Fill in: an official to manage the planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the planning policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (PL-1a)
- The [Fill in: an official to manage the planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the planning procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (PL-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### System security and privacy plans (PL-2)

> **Guidance:** PL-2 lists fifteen things a system's security and privacy plans must contain. The [System Security Plan template](https://kston83.github.io/nist-guide/templates/plans/system-security-plan/) has a section for each, so the statements below require the plan and point to its contents rather than repeating all fifteen. A system that processes personally identifiable information can keep its privacy plan as part of the security plan or as a separate document; either way, both must meet PL-2.

- Each [System owner] shall develop a security plan and a privacy plan for the system, as one document or two, that contain every element PL-2a.1 to a.14 lists. (PL-2a)
- The plans shall identify the security- and privacy-related activities affecting the system that require planning and coordination with [Fill in: individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination. Typical: the system's stakeholders, the common control providers, and the security and privacy teams]. (PL-2a.14)
- The [System owner] shall have the plans reviewed and approved by the authorizing official, or a designated representative, before the plans are implemented. (PL-2a.15)
- The [System owner] shall distribute copies of the plans, and communicate later changes to them, to [Fill in: personnel or roles to receive distributed copies of the system security and privacy plans. Typical: the authorizing official, the system owner, the system security officer and the assessor]. (PL-2b)
- The [System owner] shall review the plans [Fill in: frequency to review system security and privacy plans. Typical: annually]. (PL-2c)
- The [System owner] shall update the plans to address changes to the system and its environment of operation, and problems found during plan implementation or control assessments. (PL-2d)
- The [System owner] shall protect the plans from unauthorized disclosure and modification. (PL-2e)

### Rules of behavior (PL-4)

> **Guidance:** The [Rules of Behavior template](https://kston83.github.io/nist-guide/templates/forms/rules-of-behavior/) gives the rules, a signature block and a register of acknowledgments. Assessors sample new accounts and check that each acknowledgment is dated before access was granted.

- The [Chief Information Security Officer] shall establish rules that describe the responsibilities and expected behavior of individuals for information and system usage, security and privacy. (PL-4a)
- The [Chief Information Security Officer] shall provide the rules to each individual who requires access to the system. (PL-4a)
- The [Account manager] shall receive a documented acknowledgment from each individual, stating that they have read, understand and agree to abide by the rules, before authorizing access to information and the system. (PL-4b)
- The [Chief Information Security Officer] shall review and update the rules of behavior [Fill in: frequency for reviewing and updating the rules of behavior. Typical: annually]. (PL-4c)
- The [Chief Information Security Officer] shall require individuals who acknowledged a previous version of the rules to read and re-acknowledge them [Select one or more: [Assignment: organization-defined frequency]; when the rules are revised or updated. Typical: annually, and when the rules are revised or updated]. (PL-4d)

### Social media and external site and application usage restrictions (PL-4(1))

- The rules of behavior shall restrict the use of social media, social networking sites, and external sites and applications. (PL-4(1)(a))
- The rules of behavior shall restrict the posting of organizational information on public websites. (PL-4(1)(b))
- The rules of behavior shall restrict the use of organization-provided identifiers, such as email addresses, and authentication secrets, such as passwords, to create accounts on external sites and applications. (PL-4(1)(c))

### Security and privacy architectures (PL-8)

> **Guidance:** The architectures describe how the system is built to protect information and to limit privacy risk: the protection approach, the trust boundaries, and what the system assumes about the services it relies on. Most systems keep them as a section of the system security plan with a diagram, rather than as a separate document.

- Each [System owner] shall develop a security architecture and a privacy architecture for the system. (PL-8a)
- The architectures shall describe the requirements and approach for protecting the confidentiality, integrity and availability of organizational information. (PL-8a.1)
- The architectures shall describe the requirements and approach for processing personally identifiable information so as to minimize privacy risk to individuals. (PL-8a.2)
- The architectures shall describe how they are integrated into and support the enterprise architecture. (PL-8a.3)
- The architectures shall describe any assumptions about, and dependencies on, external systems and services. (PL-8a.4)
- The [System owner] shall review and update the architectures [Fill in: frequency for review and update to reflect changes in the enterprise architecture. Typical: annually, and whenever the enterprise architecture changes] to reflect changes in the enterprise architecture. (PL-8b)
- The [System owner] shall reflect planned architecture changes in the security and privacy plans, the concept of operations, the criticality analysis, organizational procedures, and procurements and acquisitions. (PL-8c)

### Baseline selection (PL-10)

> **Guidance:** Pick the baseline from the system's security categorization: SP 800-53B defines Low, Moderate and High security baselines and a Privacy baseline. Record the choice, and any overlay applied, in the system security plan (PL-2a.11).

- Each [System owner] shall select a control baseline for the system, based on its security categorization, and record the selection in the system security plan. (PL-10)
- A system that processes personally identifiable information shall also apply the privacy control baseline. (PL-10)

#### Federal systems

Federal systems select the SP 800-53B security baseline that matches the system's impact level: the highest impact level for confidentiality, integrity and availability under [FIPS 199](https://csrc.nist.gov/pubs/fips/199/final), as [FIPS 200](https://csrc.nist.gov/pubs/fips/200/final) specifies.

- The [System owner] shall select the baseline that matches the system's FIPS 199 impact level. (PL-10)

### Baseline tailoring (PL-11)

> **Guidance:** Tailoring adjusts the baseline to the system: identifying common controls, scoping out controls that do not apply, setting parameter values, adding controls for specific threats, and applying overlays. Assessors look for a documented reason for every control removed or marked not applicable.

- Each [System owner] shall tailor the selected control baseline by applying specified tailoring actions. (PL-11)
- The [System owner] shall document each tailoring decision, with its rationale, in the system security plan, and have the authorizing official approve it with the plan. (PL-11)

## Review and update

- The [Fill in: an official to manage the planning policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency with which the current planning policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current planning policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (PL-1c.1)
- The [Fill in: an official to manage the planning policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency with which the current planning procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (PL-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PL-1a.1(b))