Develop system security and privacy plans consistent with the enterprise architecture that define the system's components, describe its mission and business context, name the individuals in system roles, identify the information types handled, give the security categorisation with rationale, describe threats of concern, report the privacy risk assessment where PII is processed, describe the environment and connections to other systems, summarise the security and privacy requirements, name the baselines or overlays, describe the controls in place or planned with the rationale for tailoring, record risk determinations for architecture and design, list the activities needing planning and coordination, and are approved by the authorising official before implementation; distribute the plans and their changes, review them at least annually or on system change, update them for changes and problems found in implementation or assessment, and protect them from unauthorised disclosure and modification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.