# System and Communications Protection Policy **Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0 *Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution. ## Purpose This policy states what [Organization name] requires for System and Communications Protection, and who is accountable for meeting those requirements. (SC-1a.1(a)) ## Scope This policy applies at the [Select one or more: organization-level; mission/business-process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SC-1a.1(a)) ## Roles and responsibilities - The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (SC-1a.1(a)) - The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (SC-1b) - Each [System owner] shall implement this policy for their system and document how in the system security plan. (SC-1a.1(a)) - Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (SC-1a.1(a)) ## Management commitment The [Senior leader] approves this policy and shall provide the resources needed to implement it. (SC-1a.1(a)) ## Coordination The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SC-1a.1(a)) ## Compliance - This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (SC-1a.1(b)) - The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (SC-1a.1(a)) - An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (SC-1a.1(a)) - Violations of this policy shall be handled through the organization's sanctions process. (SC-1a.1(a)) ## Procedures The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (SC-1a.2) ## Dissemination - The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the system and communications protection policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (SC-1a) - The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the system and communications protection procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (SC-1a) ## Policy statements ### Personally identifiable information (SC-7(24)) - For a system that processes personally identifiable information, the [System owner] shall apply [Fill in: processing rules for systems that process personally identifiable information. Typical: the permitted purposes, recipients and data elements for each flow of personally identifiable information, as set out in the system's privacy impact assessment] to its data elements of personally identifiable information. (SC-7(24)(a)) - For such a system, the [System owner] shall monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system. (SC-7(24)(b)) - For such a system, the [System owner] shall document each processing exception. (SC-7(24)(c)) - For such a system, the [System owner] shall review processing exceptions and remove those that are no longer supported. (SC-7(24)(d)) ## Review and update - The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current system and communications protection policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current system and communications protection policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (SC-1c.1) - The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current system and communications protection procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the system and communications protection procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (SC-1c.2) ### Federal systems For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources. - Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SC-1a.1(b))