Information Security Program Plan template: The organization-wide plan for the information security program, covering every element SP 800-53 PM-1 requires, with the program management and common controls the organization provides.
The organization-wide plan for the information security program, covering every element SP 800-53 PM-1 requires, with the program management and common controls the organization provides.
This plan describes Organization name’s information security program: the requirements it meets, the program management and common controls that meet them, and who is responsible for each (PM-1a.1).
It applies to all of Organization name: Fill in: the organizational units, locations and mission and business functions the program covers. The systems in scope are listed in the system inventory (PM-5).
The Senior leader commits to the program by approving this plan and by providing the resources in the table below (PM-1a.2). Security and privacy resources are included in each capital planning and investment request (PM-3a).
Resource
Current period
Planned next period
Security staff (full-time equivalents)
Fill in: number
Fill in: number
Privacy staff (full-time equivalents)
Fill in: number
Fill in: number
Budget for security tools and services
Fill in: amount
Fill in: amount
External services (for example assessment, monitoring, incident response retainer)
Compliance with the security policies is checked through control assessments and continuous monitoring, following the continuous monitoring strategy (PM-31).
Exceptions to policy are requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with compensating measures in Fill in: where exceptions are recorded.
Violations are handled through the organization’s sanctions process.
The program reports these measures of performance to the Senior leaderFill in: how often, for example quarterly (PM-6):
Measure
Target
Source of data
Systems with a current authorization
Fill in: target, for example 100%
System inventory
Plan of action and milestones items past their due date
Fill in: target
Plans of action and milestones
Vulnerabilities remediated within the required times
Fill in: target
Vulnerability scanning
Personnel with current security awareness training
Fill in: target
Training records
Fill in: other measure
Fill in: target
Fill in: source
These arrangements describe how compliance is achieved (PM-1a.2).
The Senior leader approves this plan as the senior official responsible and accountable for the risk that Organization name incurs to its operations, assets, individuals, other organizations and the Nation (PM-1a.4).
The Chief Information Security Officer shall review and update this plan Fill in: the frequency at which to review and update the organization-wide information security program plan Typical: annually and following Fill in: events that trigger the review and update of the organization-wide information security program plan Typical: a significant change to the organization’s mission, structure, risk tolerance or systems, a major incident, or a finding from an assessment or audit of the program. (PM-1b)
The Chief Information Security Officer shall protect this plan from unauthorized disclosure and modification by keeping it in Fill in: where the plan is kept, with access limited to named roles and keeping each approved version. (PM-1c)
For federal agencies, this plan documents the agency-wide information security program required by the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554(b)). The Chief Information Security Officer is the senior agency information security officer designated under 44 U.S.C. § 3554(a)(3)(A), and the Senior privacy official is the Senior Agency Official for Privacy designated under OMB Circular A-130.
Section 2 shall list the federal laws, OMB policies and CISA directives that apply to the agency’s systems. (PM-1a.1)
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.