pl_low_impact_pri1.yaml

id: pl_low_impact_pri1
name: NIST 800-53 PL Low Impact Priority 1
milestone: Security Plan, Assessment and Authorization
issues:

  - title: As the CIO, I want to document and communicate our organization's security plan and define assessment procedures.

    body: |

      *Why:*
      We need to ensure that all relevant policies are conversant in our security plan to maintain compliance.


      *How:* 
      * Define roles in addition to ISSO or ISSM that the security plan is to be disseminated to. (State if there are no additional roles)
      * Define roles in addition to ISSO or ISSM that the security assessment procedures are to be disseminated to. (State if there are no additional roles)
      * Ensure that the security plan and assessment procedures are disseminated.
      * Define frequency at which to assess and update the security plan (Annually).
      * Maintain audit trail of reviews and updates.


      *Acceptance Criteria / Evidence:*
      * List of personnel to whom the security plan is to be disseminated
      * Security plan
      * Security plan version update page
      * Security plan audit trail of reviews and updates


      *Links:*
      * https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=PL-1
      * https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=CA-1


    labels:
      - PL
      - CA
      - PL-1
      - CA-1
      - security
      - planning
      - assessment
      - dissemination

  - title: As the CIO, I want to document and communicate our organization's security plan and define assessment procedures.

    body: |

      *Why:*
      A complete and coherent security plan is essential to share with new employees, outside organizations, or security auditors.


      *How:* 
      * Create a security plan that:
        * Is consistent with the organization's enterprise architecture
        * Explicitly defines the authorization boundary for the system
        * Describes the operational context of the system in terms of missions and business processes
        * Provides the security categorization of the system including supporting rationale
        * Describes the operational environment for the system and relationships with or connections to other systems
        * Provides an overview of the security requirements for the system
        * Identifies any relevant overlays, if applicable
        * Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions
        * Uses and documents Interconnection Security Agreements for system interconnections (CA-3)
      * Have plan approved by the authorizing official prior to implementation.
      * Frequently review security plan, including system interconnections.


      *Acceptance Criteria / Evidence:*
      * Security plan
      * Security approval documentation
      * Secuirty plan audit log


      *Links:*
      * [NIST Special Publication 800-18](http://csrc.nist.gov/publications/PubsSPs.html#800-18)
      * https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=PL-2
      * https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=CA-3

    labels:
      - PL
      - CA
      - PL-2
      - CA-3
      - security
      - planning
      - assessment

questions: []