FedRAMP High PL-2: System Security and Privacy Plans

What else in your programme already covers this

This control maps to 60 controls across 31 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 6 controls

12.1.1 12.1.1 Overall information security policy established and disseminated
12.1.2 12.1.2 Security policy reviewed annually and updated as needed
12.5.2 12.5.2 Annual and change-driven scope confirmation
12.5.2.1 12.5.2.1 Six-monthly scope confirmation for service providers
12.8.5 12.8.5 Responsibility allocation between entity and TPSPs
2.1.1 2.1.1 Requirement 2 policies and procedures governed

ISO 27001:2022 · 5 controls

5.1 Policies for information security
5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security
5.37 Documented operating procedures
5.8 Information security in project management

ISO 27002:2022 · 5 controls

5.1 Policies for information security
5.2 Information security roles and responsibilities
5.35 Independent review of information security
5.37 Documented operating procedures
5.8 Information security in project management

HIPAA Security Rule · 4 controls

164.306 Security Standards: General Rules
164.316(a) Policies and Procedures (Standard)
164.316(b)(1) Documentation (Standard)
164.316(b)(2)(iii) Updates (Documentation)

SOC 2 · 4 controls

SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
SOC2-CC3.1 CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)

C5 (Germany) · 3 controls

C5-COM-01 Identification of applicable legal, regulatory, self-imposed or contractual requirements
C5-OIS-01 Information Security Management System (ISMS)
C5-OIS-02 Information Security Policy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-A&A-04 Requirements Compliance
CCM-GRC-05 Information Security Program
CCM-GRC-07 Information System Regulatory Mapping

APEC Cross-Border Privacy Rules (CBPR) System · 2 controls

CBPR-PR-26 Information security policy
CBPR-PR-39 Measures to ensure compliance

Australia Consumer Data Right - Banking (CDR) · 2 controls

AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data
AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment

GDPR · 2 controls

GDPR-Art.24 Responsibility of the controller
GDPR-Art.30 Records of processing activities

ISO 27701:2019 · 2 controls

5.1 General
5.2.3 Determining the scope of the information security management system

NIS2 Directive · 2 controls

Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation
Art.21.2.a Policies on risk analysis and on information system security

NIST SP 800-66 Rev 2 · 2 controls

164.316(a) Policies and Procedures (Standard)
164.316(b)(1) Documentation (Standard)

APRA CPS 230 Operational Risk Management · 1 control

CPS230-P27 Comprehensive Assessment of the Operational Risk Profile

AWS Well-Architected Security Pillar · 1 control

SEC01-BP03 Identify and validate control objectives

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-1 Written security and access policy

Australian Privacy Principles (APPs) · 1 control

APP-1 APP 1 - Open and transparent management of personal information

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-1 Program of Risk Analysis and Oversight

CMMC 2.0 · 1 control

CA.L2-3.12.4 System Security Plan

DORA · 1 control

DORA-Art.6 ICT risk management framework

ISO 22301:2019 · 1 control

4.3.2 Scope of the business continuity management system

ISO/IEC 42001:2023 · 1 control

A.6.2.3 Documentation of AI system design and development

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management

NIST SP 800-161 Rev 1 · 1 control

161R1-PL-2 System Security and Privacy Plans

NIST SP 800-171 Rev 3 · 1 control

03.15.02 System Security Plan

NIST SP 800-172 · 1 control

3.11.4e Security Solution Rationale Document

NIST SP 800-53 Rev 5 · 1 control

NIST800-PL-2 PL-2 System Security and Privacy Plans

NIST SP 800-53 Rev 5 HIGH · 1 control

PL-2 PL-2 System Security and Privacy Plans

NIST SP 800-53 Rev 5 LOW · 1 control

PL-2 PL-2 System Security and Privacy Plans

NIST SP 800-53 Rev 5 MODERATE · 1 control

PL-2 PL-2 System Security and Privacy Plans

UK Cyber Essentials · 1 control

CE-SCOPE.1 Scope Definition

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.