Planning Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for planning in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers security and privacy planning for every system. The Organization plans security before it builds or changes a system. Every system must have a current System Security and Privacy Plan (SSPP) that states its boundary, architecture, and control implementation. Every user must acknowledge the rules of behavior. The Organization must align security architecture with the enterprise architecture. It must document and justify its baseline selection, including the Cybersecurity and Infrastructure Security Agency (CISA) High Value Asset (HVA) overlay where a system is designated a High Value Asset.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• GV.OC — Organizational Context (Govern function)
• GV.PO — Policy (Govern function)

These categories fall under the Govern function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every planning control in the moderate baseline of FIPS 200 and NIST SP 800-53B:

• PL-01 — Policy and Procedures
• PL-02 — System Security and Privacy Plans
• PL-04 — Rules of Behavior
• PL-04(1) — Social Media and External Site/Application Usage Restrictions
• PL-08 — Security and Privacy Architectures
• PL-09 — Central Management
• PL-10 — Baseline Selection
• PL-11 — Baseline Tailoring

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• NIST SP 800-18 Rev. 2: Developing System Plans (system security plans, system privacy plans, C-SCRM plans), June 30, 2026.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PL control family. They add to the NIST SP 800-53 control requirements in the Policy section.

NIST SP 800-53B: Control Baselines

• The organization must base control selection on the FIPS 199 security categorization, using the baselines in SP 800-53B as a starting point. Baselines must be tailored using the tailoring guidance to reflect the system’s specific risk environment and mission requirements. (NIST SP 800-53B, §3)
• The organization should develop overlays to customize control baselines for specific communities of interest, technologies, or environments. Overlays must document the rationale for additions, modifications, or compensating controls. (NIST SP 800-53B, §4)

OMB Circular A-130: Managing Information as a Strategic Resource

• The organization must establish governance structures for information resources management, including IT investment management, information security, and privacy programs. Senior agency officials must be designated for security and privacy. (OMB Circular A-130, §5.f)

CISA High Value Asset (HVA) Control Overlay v1.0

• The organization must apply the CISA HVA Control Overlay to HVA-designated systems as a starting point for enhanced protection — layering the overlay’s system-level and enterprise control selections (51 controls and enhancements across AC, AU, CA, CM, CP, IA, IR, RA, SA, SC, SI) on top of the FIPS 199 baseline, and applying additional overlays as threat or regulation requires. (CISA HVA Control Overlay v1.0, §Overlay Application)

NIST SP 800-18 Rev 2: Developing System Plans

• The organization must develop and maintain system plans — the system security plan, system privacy plan, and cybersecurity supply chain risk management plan — as a coherent set that is kept current through the authorization cycle and, where practicable, machine-readable (OSCAL). (NIST SP 800-18 Rev 2)

3. Policy #

The Organization must implement and maintain its planning controls to meet the following requirements:

PL-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.PO (Policy)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] planning policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the planning policy and the associated planning controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the planning policy and procedures; and
3. Review and update the current planning:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep a planning policy at the organization level and the system level, and the procedures that put it into practice. The policy states its purpose and scope, assigns roles, records management’s commitment, provides for coordination across the Organization, and sets compliance expectations. It must stay consistent with the governance structures that OMB Circular A-130 requires. The procedures must make each planning control executable. The CISO must develop, document, and distribute both documents to the Authorizing Official (AO), System Owners, Information System Security Officers (ISSOs), and key stakeholders. The CISO must review and update the policy and the procedures every year, and sooner when a major change to applicable policy requires it.

PL-02 — System Security and Privacy Plans #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.OC (Organizational Context), GV.PO (Policy)

Requirement:

1. Develop security and privacy plans for the system that:

1. Are consistent with the organization’s enterprise architecture;
2. Explicitly define the constituent system components;
3. Describe the operational context of the system in terms of mission and business processes;
4. Identify the individuals that fulfill system roles and responsibilities;
5. Identify the information types processed, stored, and transmitted by the system;
6. Provide the security categorization of the system, including supporting rationale;
7. Describe any specific threats to the system that are of concern to the organization;
8. Provide the results of a privacy risk assessment for systems processing personally identifiable information;
9. Describe the operational environment for the system and any dependencies on or connections to other systems or system components;
10. Provide an overview of the security and privacy requirements for the system;
11. Identify any relevant control baselines or overlays, if applicable;
12. Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;
13. Include risk determinations for security and privacy architecture and design decisions;
14. Include security- and privacy-related activities affecting the system that require planning and coordination with to include chief privacy and ISSO and/or similar role or designees; and
15. Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.

2. Distribute copies of the plans and communicate subsequent changes to the plans to include chief privacy and ISSO and/or similar role;
3. Review the plans at least annually;
4. Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and
5. Protect the plans from unauthorized disclosure and modification.

Implementation guidance:

System Owners must develop a System Security and Privacy Plan (SSPP) for each system. The SSPP must fit the enterprise architecture and define the system’s components and boundary. It must describe the operational and threat context, name the role holders, and list the information types. It must record the security categorization with its rationale, and it must include the privacy risk assessment when the system processes personally identifiable information. It must explain the controls selected, including tailoring decisions, against the requirements they satisfy. The System Owner must identify in the SSPP any activity that needs coordination with the CISO, Information System Security Manager (ISSM), or Privacy Officer. The AO or designated representative must approve the SSPP before implementation begins. Distribution of the SSPP must include, at minimum, the AO, the System Owner, and the ISSO. The System Owner must review the SSPP at least every year, and sooner after a significant change to the boundary, architecture, privacy impact assessment (PIA), or information types. The System Owner must update the SSPP when the system or its assessment results require it. The System Owner must protect the SSPP from unauthorized disclosure and modification.

PL-04 — Rules of Behavior #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.OC (Organizational Context), GV.PO (Policy)

Requirement:

1. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;
2. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;
3. Review and update the rules of behavior at least every 3 years; and
4. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge at least annually and when the rules are revised or changed.

Implementation guidance:

The CISO must establish rules of behavior that describe each person’s responsibilities and expected conduct for information and system use, security, and privacy. The Organization must give the rules to every individual before it authorizes that individual’s access. No one receives access until their signed or electronic acknowledgment is on record. The acknowledgment states that the person has read, understood, and agreed to the rules, and it is a condition of access. The CISO must review and update the rules every 3 years and whenever changes require it. Every person must acknowledge the rules again [PL-04 parameter 3 — to be defined], when completing the annual security awareness training, and again whenever the CISO revises the rules. Access held without a current acknowledgment is out of policy.

PL-04(1) — Social Media and External Site/Application Usage Restrictions #

Baselines: Low / Moderate / High / Privacy

Requirement:

Include in the rules of behavior, restrictions on: (a) Use of social media, social networking sites, and external sites/applications; (b) Posting organizational information on public websites; and (c) Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.

Implementation guidance:

The CISO must address social media, social networking, and external sites and applications directly in the rules of behavior. The rules restrict how personnel use these services for official business. Personnel must not post non-public organizational information, including personally identifiable information and account details, to these services. Personnel must not use organizational credentials to register for or sign in to external services. The CISO must keep these restrictions current as platforms and their risks change. Every acknowledgment of the rules covers these restrictions.

PL-08 — Security and Privacy Architectures #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.PO (Policy)

Requirement:

1. Develop security and privacy architectures for the system that:

1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
3. Describe how the architectures are integrated into and support the enterprise architecture; and
4. Describe any assumptions about, and dependencies on, external systems and services;

2. Review and update the architectures at least annually and when a significant change occurs to reflect changes in the enterprise architecture; and
3. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.

Implementation guidance:

System Owners must develop a security architecture and a privacy architecture for each system. The architectures must describe how the system protects the confidentiality, integrity, and availability of organizational information. They must describe how the system handles personally identifiable information so privacy risk to individuals stays as low as possible. They must show how the system’s design fits into and supports the enterprise architecture. The Enterprise Architecture Policy sets the enterprise security architecture each system must fit. They must state what the system assumes about the external services and interconnected systems it depends on. The System Owner must review and update the architectures at least every year, and sooner when the boundary, system architecture, PIA, or information types change significantly. The review keeps the architectures aligned with changes to the enterprise architecture. The System Owner must carry planned architecture changes into the System Security and Privacy Plan (SSPP), the CONOPS, the criticality analysis, organizational procedures, and procurements. Those documents then stay consistent with the architecture.

PL-09 — Central Management #

Baselines: Privacy

Requirement:

Centrally manage [Assignment: organization-defined controls and related processes — to be defined].

Implementation guidance:

The CISO must manage the following controls and processes centrally for the whole Organization: [PL-09 parameter 1 — to be defined]. The CISO must assign each centrally managed control to a Common Control Provider. The Common Control Provider must document that control once in the governance, risk, and compliance (GRC) system so that systems can inherit it. System Owners must inherit a centrally managed control where it covers their system. For a hybrid control, the System Owner must document only the part the system implements. The ISSO for each system must record each inherited control in the System Security and Privacy Plan (SSPP) in the GRC system. Common Control Providers must keep each common control’s description, assessment results, and plan of action and milestones (POA&M) items current in the GRC system. As NIST SP 800-18 Rev 2 directs, the SSPP and these records must stay current through the authorization cycle. The CISO must decide which controls to add to central management when a baseline or overlay changes. The CISO’s staff must keep the list of centrally managed controls in the policy library in the document management system.

PL-10 — Baseline Selection #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: GV.PO (Policy)

Requirement:

Select a control baseline for the system.

Implementation guidance:

The System Owner must select a control baseline for every system based on the system’s Federal Information Processing Standards (FIPS) 199 security categorization. The selection must stay consistent with the governance that OMB Circular A-130 establishes for security and privacy programs. The System Owner must base the selection on the information types the system handles, the harm their compromise would cause, and the results of the risk assessment. For a system designated as a high value asset, the System Owner must apply the CISA HVA Control Overlay on top of the baseline as the starting point for enhanced protection. The System Owner must apply further overlays when a threat or regulation requires them. The AO must concur with the baseline selection as part of authorization. The System Owner must record the selection and its rationale in the System Security and Privacy Plan (SSPP). Baseline selection is the first risk decision a system’s protection depends on, and the System Owner makes it deliberately.

PL-11 — Baseline Tailoring #

Baselines: Low / Moderate / High CSF 2.0: GV.PO (Policy)

Requirement:

Tailor the selected control baseline by applying specified tailoring actions.

Implementation guidance:

The System Owner must tailor the selected baseline with the established tailoring actions. The System Owner designates the common controls the system inherits and applies scoping decisions where a control does not fit the system. The System Owner substitutes compensating controls where the written implementation is not feasible, assigns organization-defined parameter values, and adds controls where risk demands more than the baseline provides. The System Owner must document every tailoring action with its rationale in the System Security and Privacy Plan (SSPP). A removal without documentation is a gap, not a tailoring decision. The ISSO must review the tailoring to confirm that it is defensible. The AO must accept the tailored control set through the authorization decision. Every departure from the baseline is a risk decision, and it must stay visible.

High Value Assets #

The Organization has systems designated as High Value Assets (HVAs). Each HVA must meet the controls in its baseline plus the controls the CISA HVA Control Overlay selects, as OMB M-19-03 directs. In this policy and its procedure, a control marked “HVA overlay” under its baselines applies to every HVA.

• The CISO must keep the Organization’s HVA inventory, review it every year, and send it to CISA as OMB M-19-03 requires.
• Each System Owner must assess whether the system meets one of the three OMB M-19-03 HVA categories: informational value, mission essential, or federal civilian enterprise essential.
• The System Owner of each HVA must apply the CISA HVA Control Overlay on top of the system’s baseline and record each overlay control in the System Security and Privacy Plan (SSPP).
• Each HVA must receive the independent assessment OMB M-19-03 requires, by CISA or by an assessor the CISO approves.
• The System Owner must fix each critical or high weakness from an HVA assessment within 30 days of the final report. If a fix takes longer, the System Owner must record a dated plan of action and milestones (POA&M) item within those 30 days.

Source: OMB M-19-03, Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program; CISA High Value Asset Control Overlay.

Related Required Processes #

• The SSPP is built and approved in Risk Management Framework (RMF) tasks C-1, S-1 through S-6, and I-2. The Assessment, Authorization, and Monitoring procedure lists every RMF task and who does it.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of planning controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves planning through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Generate SSPP content from live configuration and inventory data so plans stay current without manual rewrites.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• CISA High Value Asset (HVA) Control Overlay v1.0, November 1, 2017.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 199: Standards for Security Categorization, February 2004.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-18 Rev. 2: Developing System Plans (system security plans, system privacy plans, C-SCRM plans), June 30, 2026.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.