Planning Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the PL control family policy (POL-PL). It covers every control in the planning family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the PL family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the high security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• GV.OC — Organizational Context (Govern function)
• GV.PO — Policy (Govern function)

3. Controls Covered #

This procedure covers the following 8 controls in the PL family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PL control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

NIST SP 800-53B: Control Baselines

• The organization must base control selection on the FIPS 199 security categorization, using the baselines in SP 800-53B as a starting point. Baselines must be tailored using the tailoring guidance to reflect the system’s specific risk environment and mission requirements. (NIST SP 800-53B, §3)
• The organization should develop overlays to customize control baselines for specific communities of interest, technologies, or environments. Overlays must document the rationale for additions, modifications, or compensating controls. (NIST SP 800-53B, §4)

OMB Circular A-130: Managing Information as a Strategic Resource

• The organization must establish governance structures for information resources management, including IT investment management, information security, and privacy programs. Senior agency officials must be designated for security and privacy. (OMB Circular A-130, §5.f)

CISA High Value Asset (HVA) Control Overlay v1.0

• The organization must apply the CISA HVA Control Overlay to HVA-designated systems as a starting point for enhanced protection — layering the overlay’s system-level and enterprise control selections (51 controls and enhancements across AC, AU, CA, CM, CP, IA, IR, RA, SA, SC, SI) on top of the FIPS 199 baseline, and applying additional overlays as threat or regulation requires. (CISA HVA Control Overlay v1.0, §Overlay Application)

NIST SP 800-18 Rev 2: Developing System Plans

• The organization must develop and maintain system plans — the system security plan, system privacy plan, and cybersecurity supply chain risk management plan — as a coherent set that is kept current through the authorization cycle and, where practicable, machine-readable (OSCAL). (NIST SP 800-18 Rev 2)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the PL controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Planning family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The CISO / Privacy Officer (SAOP) carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the PL policy (POL-PL) for the role definitions.

4.2 Control-Specific Procedures #

PL-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.PO (Policy)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] planning policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the planning policy and the associated planning controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the planning policy and procedures; and
3. Review and update the current planning:

1. Policy at least annually and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The CISO’s office keeps POL-PL and PROC-PL under version control and owns their lifecycle. The CISO’s office opens a tracked review task every two years. It opens one sooner when a major change to applicable policy requires an off-cycle review. The CISO asks System Owners and Information System Security Officers (ISSOs) where planning practice has departed from the written procedure. The CISO adds changes from new federal direction and drafts the revision.

The CISO’s office distributes the approved revision to the Authorizing Official (AO), System Owners, ISSOs, and key stakeholders. The CISO’s office records the distribution in the review record. The CISO’s office archives prior versions with their effective dates, so anyone can establish which planning rule was in force on any past date.

Evidence: the version-controlled documents with their change history, the review records that show the trigger, input, and approval, and the distribution records for each release.

PL-02 — System Security and Privacy Plans #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.OC (Organizational Context), GV.PO (Policy)

1. Develop security and privacy plans for the system that:

1. Are consistent with the organization’s enterprise architecture;
2. Explicitly define the constituent system components;
3. Describe the operational context of the system in terms of mission and business processes;
4. Identify the individuals that fulfill system roles and responsibilities;
5. Identify the information types processed, stored, and transmitted by the system;
6. Provide the security categorization of the system, including supporting rationale;
7. Describe any specific threats to the system that are of concern to the organization;
8. Provide the results of a privacy risk assessment for systems processing personally identifiable information;
9. Describe the operational environment for the system and any dependencies on or connections to other systems or system components;
10. Provide an overview of the security and privacy requirements for the system;
11. Identify any relevant control baselines or overlays, if applicable;
12. Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;
13. Include risk determinations for security and privacy architecture and design decisions;
14. Include security- and privacy-related activities affecting the system that require planning and coordination with to include chief privacy and ISSO and/or similar role or designees; and
15. Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.

2. Distribute copies of the plans and communicate subsequent changes to the plans to include chief privacy and ISSO and/or similar role;
3. Review the plans at least annually;
4. Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and
5. Protect the plans from unauthorized disclosure and modification.

Procedure:

The System Owner drafts the System Security and Privacy Plan (SSPP) at system initiation from the Organization’s plan template. The System Owner works with the ISSO on the control descriptions and with the Privacy Officer when the system processes personally identifiable information. The System Owner records coordination items that involve the CISO or Information System Security Manager (ISSM) in the plan itself. The completed draft goes to the AO or designated representative, who records approval before implementation proceeds.

The System Owner distributes the approved SSPP to the AO, System Owner, and ISSO and stores it with access restricted to people who need it. At least every year, and sooner when the boundary, architecture, privacy impact assessment (PIA), or information types change significantly, the System Owner reviews the plan. The System Owner updates it for system and environment changes and for problems that control assessments found, and the revision goes back through approval and distribution. The governance, risk, and compliance (GRC) system holds the review and approval actions with the plan’s version history.

Evidence: the approved plan with its version history, AO approval records, distribution records, and the yearly review records with the changes each cycle produced.

PL-04 — Rules of Behavior #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.OC (Organizational Context), GV.PO (Policy)

1. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;
2. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;
3. Review and update the rules of behavior at least annually; and
4. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge at least annually and when the rules are revised or changed.

Procedure:

During onboarding, before any account is provisioned, the individual receives the current rules of behavior. The individual acknowledges the rules with an electronic signature or a signed form, and the record goes on file. Account provisioning depends on that acknowledgment: the access request does not proceed without it.

Each year, users acknowledge the rules again as a step in the annual security awareness course in the learning management system (LMS). The CISO maintains the rules and reviews them every year and whenever changes occur, such as new obligations, changed technology, or revised federal direction. When the CISO publishes a revision, current users receive the updated rules and must acknowledge them again to keep their access.

The ISSO compares the acknowledgment records with the list of account holders, so coverage is measurable. The ISSO refers users who have not acknowledged to their supervisor. If a user still has not acknowledged after that, the account manager suspends the user’s access.

Evidence: the versioned rules of behavior, the acknowledgment records tied to individuals and versions, the annual and revision acknowledgment records, and the follow-up record for users who lapsed.

PL-04(1) — Social Media and External Site/Application Usage Restrictions #

Baselines: Low / Moderate / High / Privacy

Include in the rules of behavior, restrictions on: (a) Use of social media, social networking sites, and external sites/applications; (b) Posting organizational information on public websites; and (c) Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.

Procedure:

The social media and external site restrictions are part of the rules of behavior, so they follow the same lifecycle. Individuals receive them before access, acknowledge them in writing or electronically, and re-acknowledge them when the CISO revises them. The CISO reviews the restrictions with each rules-of-behavior update and adjusts them as new platforms or risks appear. Anyone who suspects a violation reports it to the ISSO, for example organizational information that appears on an external site or agency credentials used to sign up for outside services. The ISSO handles each report through the incident and sanctions processes and records the report and outcome in the ticketing system. Evidence: the restriction text within each version of the rules, the acknowledgment records, and violation reports with their disposition.

PL-08 — Security and Privacy Architectures #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.PO (Policy)

1. Develop security and privacy architectures for the system that:

1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
3. Describe how the architectures are integrated into and support the enterprise architecture; and
4. Describe any assumptions about, and dependencies on, external systems and services;

2. Review and update the architectures at least annually and when a significant change occurs to reflect changes in the enterprise architecture; and
3. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.

Procedure:

The System Owner drafts the architecture alongside the system’s System Security and Privacy Plan (SSPP). The System Owner works with the ISSO, and with the Privacy Officer when personally identifiable information is in scope. The System Owner documents the protection approach for confidentiality, integrity, and availability. The System Owner also documents the design that minimizes privacy risk in personally identifiable information (PII) handling, the fit with the enterprise architecture, and the assumptions about external services and interconnected systems. The System Owner files the architecture with the system’s authorization documentation. For a new system or a major change, the Architecture Review Board reviews the architecture under the Enterprise Architecture Procedure.

The System Owner reviews the document at least every year against the system as built and operated. The System Owner also reviews it when a significant change affects the boundary, architecture, PIA, or information types. The review covers what changed in the enterprise architecture, which dependencies appeared or disappeared, and what the design now needs. When a change is approved, the ISSO confirms that the SSPP, CONOPS, criticality analysis, procedures, and any affected procurement documents match it. The ISSO tracks those updates in the ticketing system.

Evidence: the versioned architecture documents, yearly review records, and the tickets that show downstream documents updated after each architecture change.

PL-09 — Central Management #

Baselines: Privacy

Centrally manage [Assignment: organization-defined controls and related processes — to be defined].

Procedure:

The CISO’s staff keep the list of centrally managed controls in the document management system and the matching common control records in the GRC system. When the CISO adds a control to central management, the CISO names a Common Control Provider for it. The Common Control Provider writes the control description in the GRC system and marks it available for inheritance.

When a System Owner starts an SSPP in the GRC system, the ISSO selects the common controls the system inherits. For a hybrid control, the ISSO writes only the system-specific part and links it to the common control record.

The CISO arranges one assessment of each centrally managed control at the provider level. The Common Control Provider loads the results into the GRC system and opens a plan of action and milestones (POA&M) item for each weakness. Each System Owner that inherits the control can then see its status in the GRC system. The Authorizing Official reviews the status of inherited controls before signing an authorization.

Evidence: the list of centrally managed controls in the document management system, the common control records and inheritance links in the GRC system, the provider-level assessment results, and the related POA&M items.

PL-10 — Baseline Selection #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: GV.PO (Policy)

Select a control baseline for the system.

Procedure:

Baseline selection happens at system initiation, immediately after categorization. The System Owner takes the Federal Information Processing Standards (FIPS) 199 categorization, which comes from the system’s information types and the impact analysis behind them, and selects the matching control baseline. The System Owner documents the choice and its rationale in the System Security and Privacy Plan (SSPP). The ISSO checks that the selection is consistent with the categorization.

If the system carries a high value asset designation, the System Owner applies the Cybersecurity and Infrastructure Security Agency (CISA) HVA Control Overlay on top of the selected baseline. The System Owner adds any other overlay that a threat or regulation requires and records each one with its justification. The assembled selection goes with the plan to the AO, whose approval closes the decision.

The System Owner revisits the selection when recategorization, a mission change, or a new designation changes the basis for it. Evidence: the categorization record, the documented baseline selection and overlay applications in the plan, and the AO approval that accepted them.

PL-11 — Baseline Tailoring #

Baselines: Low / Moderate / High CSF 2.0: GV.PO (Policy)

Tailor the selected control baseline by applying specified tailoring actions.

Procedure:

Tailoring follows baseline selection in the same planning pass. The System Owner works through the baseline control by control. The System Owner designates inherited common controls with their providers. The System Owner removes controls that are out of scope for the system’s architecture and writes down the scoping rationale. The System Owner proposes compensating controls where the standard implementation cannot work, sets parameter values, and adds controls where the risk assessment shows the baseline is not enough.

The System Owner records each action with its justification in the System Security and Privacy Plan (SSPP). The ISSO reviews the full tailoring record for consistency, with the closest attention to removals and compensating controls, before the plan goes to the AO. The AO’s authorization decision accepts the tailored set.

The System Owner reopens tailoring when an assessment finds a compensating control underperforming or when a system change invalidates a scoping decision. Evidence: the tailoring documentation in the plan, the ISSO review record, and the AO acceptance within the authorization decision.

4.3 High Value Asset Steps #

These steps apply to every system designated as a High Value Asset (HVA). The ISSO records the result of each step in the GRC system.

Step 1: Identify and Protect HVAs #

Find each HVA, report it, and add the overlay controls.

Source: OMB M-19-03, Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program; CISA High Value Asset Control Overlay.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for PL
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric CG.01
• Evidence for IG FISMA metric CG.03
• Evidence for IG FISMA metric CG.04

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• NIST SP 800-18 Rev. 2: Developing System Plans (system security plans, system privacy plans, C-SCRM plans), June 30, 2026.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• CISA High Value Asset (HVA) Control Overlay v1.0, November 1, 2017.
• FIPS 199: Standards for Security Categorization, February 2004.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.