Planning Decision Worksheet

Planning Decision Worksheet template: Every decision the Planning family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Planning family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every PL control in the baseline, with a typical value where the Planning Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

18 decisions.

Decision	Control	Typical value	Who decides
Is each system’s privacy plan part of its security plan, or a separate document?	PL-2	One combined plan for most systems; a separate privacy plan where the privacy office maintains it.	Chief Information Security Officer
Where are security plans kept, and in what format?	PL-2	The System Security Plan template as a document, with control details in a GRC tool, access limited to named roles.	Chief Information Security Officer
Which overlays, if any, apply on top of the baselines?	PL-10, PL-11	None by default; an overlay where a sector, regulator or customer requires one.	Authorizing official
Personnel or roles to whom the planning policy is to be disseminated	PL-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the planning procedures are to be disseminated	PL-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	PL-1	Organization-level	Chief Information Security Officer
An official to manage the planning policy and procedures	PL-1	Chief Information Security Officer	Chief Information Security Officer
The frequency with which the current planning policy is reviewed and updated	PL-1	Annually	Chief Information Security Officer
Events that would require the current planning policy to be reviewed and updated	PL-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency with which the current planning procedures are reviewed and updated	PL-1	Annually	Chief Information Security Officer
Events that would require procedures to be reviewed and updated	PL-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination	PL-2	The system’s stakeholders, the common control providers, and the security and privacy teams	Chief Information Security Officer
Personnel or roles to receive distributed copies of the system security and privacy plans	PL-2	The authorizing official, the system owner, the system security officer and the assessor	Chief Information Security Officer
Frequency to review system security and privacy plans	PL-2	Annually	Chief Information Security Officer
Frequency for reviewing and updating the rules of behavior	PL-4	Annually	Chief Information Security Officer
Select one or more: organization-defined frequency (see its row below); when the rules are revised or updated	PL-4	Annually, and when the rules are revised or updated	Chief Information Security Officer
Frequency for individuals to read and re-acknowledge the rules of behavior	PL-4	Annually	Chief Information Security Officer
Frequency for review and update to reflect changes in the enterprise architecture	PL-8	Annually, and whenever the enterprise architecture changes	Chief Information Security Officer