Planning Policy

Planning Policy template: Ready-to-adopt Planning policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Planning policy states what the organization requires for planning and who is accountable for it. It meets PL-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. PL-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
PL-1	Policy and Procedures	Yes	Yes	Yes	Yes
PL-2	System Security and Privacy Plans	Yes	Yes	Yes	Yes
PL-4	Rules of Behavior	Yes	Yes	Yes	Yes
PL-4(1)	Social Media and External Site/Application Usage Restrictions	Yes	Yes	Yes	Yes
PL-8	Security and Privacy Architectures		Yes	Yes	Yes
PL-9	Central Management				Yes
PL-10	Baseline Selection	Yes	Yes	Yes
PL-11	Baseline Tailoring	Yes	Yes	Yes

Decisions to make first

The policy has 16 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Is each system’s privacy plan part of its security plan, or a separate document?	PL-2	One combined plan for most systems; a separate privacy plan where the privacy office maintains it.	Chief Information Security Officer
Where are security plans kept, and in what format?	PL-2	The System Security Plan template as a document, with control details in a GRC tool, access limited to named roles.	Chief Information Security Officer
Which overlays, if any, apply on top of the baselines?	PL-10, PL-11	None by default; an overlay where a sector, regulator or customer requires one.	Authorizing official

Record your values in the Planning decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: PL pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet PL-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PL-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Planning, and who is accountable for meeting those requirements. (PL-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PL-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (PL-1a.1(a))
• The Fill in: an official to manage the planning policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (PL-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (PL-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (PL-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (PL-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PL-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (PL-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (PL-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (PL-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (PL-1a.1(a))

Procedures

The Fill in: an official to manage the planning policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (PL-1a.2)

Dissemination

• The Fill in: an official to manage the planning policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the planning policy is to be disseminated Typical: everyone within its scope, through the policy library. (PL-1a)
• The Fill in: an official to manage the planning policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the planning procedures are to be disseminated Typical: the people who carry them out, and the system owners. (PL-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

System security and privacy plans (PL-2)

Guidance

PL-2 lists fifteen things a system’s security and privacy plans must contain. The System Security Plan template has a section for each, so the statements below require the plan and point to its contents rather than repeating all fifteen. A system that processes personally identifiable information can keep its privacy plan as part of the security plan or as a separate document; either way, both must meet PL-2.

• Each System owner shall develop a security plan and a privacy plan for the system, as one document or two, that contain every element PL-2a.1 to a.14 lists. (PL-2a)
• The plans shall identify the security- and privacy-related activities affecting the system that require planning and coordination with Fill in: individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination Typical: the system’s stakeholders, the common control providers, and the security and privacy teams. (PL-2a.14)
• The System owner shall have the plans reviewed and approved by the authorizing official, or a designated representative, before the plans are implemented. (PL-2a.15)
• The System owner shall distribute copies of the plans, and communicate later changes to them, to Fill in: personnel or roles to receive distributed copies of the system security and privacy plans Typical: the authorizing official, the system owner, the system security officer and the assessor. (PL-2b)
• The System owner shall review the plans Fill in: frequency to review system security and privacy plans Typical: annually. (PL-2c)
• The System owner shall update the plans to address changes to the system and its environment of operation, and problems found during plan implementation or control assessments. (PL-2d)
• The System owner shall protect the plans from unauthorized disclosure and modification. (PL-2e)

Rules of behavior (PL-4)

Guidance

The Rules of Behavior template gives the rules, a signature block and a register of acknowledgments. Assessors sample new accounts and check that each acknowledgment is dated before access was granted.

• The Chief Information Security Officer shall establish rules that describe the responsibilities and expected behavior of individuals for information and system usage, security and privacy. (PL-4a)
• The Chief Information Security Officer shall provide the rules to each individual who requires access to the system. (PL-4a)
• The Account manager shall receive a documented acknowledgment from each individual, stating that they have read, understand and agree to abide by the rules, before authorizing access to information and the system. (PL-4b)
• The Chief Information Security Officer shall review and update the rules of behavior Fill in: frequency for reviewing and updating the rules of behavior Typical: annually. (PL-4c)
• The Chief Information Security Officer shall require individuals who acknowledged a previous version of the rules to read and re-acknowledge them Select one or more: [Assignment: organization-defined frequency]; when the rules are revised or updated Typical: annually, and when the rules are revised or updated. (PL-4d)

Social media and external site and application usage restrictions (PL-4(1))

• The rules of behavior shall restrict the use of social media, social networking sites, and external sites and applications. (PL-4(1)(a))
• The rules of behavior shall restrict the posting of organizational information on public websites. (PL-4(1)(b))
• The rules of behavior shall restrict the use of organization-provided identifiers, such as email addresses, and authentication secrets, such as passwords, to create accounts on external sites and applications. (PL-4(1)(c))

Security and privacy architectures (PL-8)

Guidance

The architectures describe how the system is built to protect information and to limit privacy risk: the protection approach, the trust boundaries, and what the system assumes about the services it relies on. Most systems keep them as a section of the system security plan with a diagram, rather than as a separate document.

• Each System owner shall develop a security architecture and a privacy architecture for the system. (PL-8a)
• The architectures shall describe the requirements and approach for protecting the confidentiality, integrity and availability of organizational information. (PL-8a.1)
• The architectures shall describe the requirements and approach for processing personally identifiable information so as to minimize privacy risk to individuals. (PL-8a.2)
• The architectures shall describe how they are integrated into and support the enterprise architecture. (PL-8a.3)
• The architectures shall describe any assumptions about, and dependencies on, external systems and services. (PL-8a.4)
• The System owner shall review and update the architectures Fill in: frequency for review and update to reflect changes in the enterprise architecture Typical: annually, and whenever the enterprise architecture changes to reflect changes in the enterprise architecture. (PL-8b)
• The System owner shall reflect planned architecture changes in the security and privacy plans, the concept of operations, the criticality analysis, organizational procedures, and procurements and acquisitions. (PL-8c)

Baseline selection (PL-10)

Guidance

Pick the baseline from the system’s security categorization: SP 800-53B defines Low, Moderate and High security baselines and a Privacy baseline. Record the choice, and any overlay applied, in the system security plan (PL-2a.11).

• Each System owner shall select a control baseline for the system, based on its security categorization, and record the selection in the system security plan. (PL-10)
• A system that processes personally identifiable information shall also apply the privacy control baseline. (PL-10)

Federal systems

Federal systems select the SP 800-53B security baseline that matches the system’s impact level: the highest impact level for confidentiality, integrity and availability under FIPS 199, as FIPS 200 specifies.

• The System owner shall select the baseline that matches the system’s FIPS 199 impact level. (PL-10)

Baseline tailoring (PL-11)

Guidance

Tailoring adjusts the baseline to the system: identifying common controls, scoping out controls that do not apply, setting parameter values, adding controls for specific threats, and applying overlays. Assessors look for a documented reason for every control removed or marked not applicable.

• Each System owner shall tailor the selected control baseline by applying specified tailoring actions. (PL-11)
• The System owner shall document each tailoring decision, with its rationale, in the system security plan, and have the authorizing official approve it with the plan. (PL-11)

Review and update

• The Fill in: an official to manage the planning policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency with which the current planning policy is reviewed and updated Typical: annually and following Fill in: events that would require the current planning policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (PL-1c.1)
• The Fill in: an official to manage the planning policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency with which the current planning procedures are reviewed and updated Typical: annually and following Fill in: events that would require procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (PL-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PL-1a.1(b))