FedRAMP High PL-2: System Security and Privacy Plans

What else in your programme already covers this

This control maps to 57 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 6 controls

12.1.1 An overall information security policy is: • Established. • Published. • Maintained. • Disseminated to all relevant personnel, as well as to relevant vendors and business partners
12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
12.5.2 PCI DSS scope documented and confirmed annually
12.5.2.1 Service provider scope confirmed every 6 months
12.8.5 Responsibility matrix with TPSPs
2.1.1 All security policies and operational procedures that are identified in Requirement 2 are: • Documented. • Kept up to date. • In use. • Known to all affected parties

ISO 27001:2022 · 5 controls

5.1 Policies for information security
5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security
5.37 Documented operating procedures
5.8 Information security in project management

ISO 27002:2022 · 5 controls

5.1 Policies for information security
5.2 Information security roles and responsibilities
5.35 Independent review of information security
5.37 Documented operating procedures
5.8 Information security in project management

HIPAA Security Rule · 4 controls

164.306 Security Standards: General Rules
164.316(a) Policies and Procedures (Standard)
164.316(b)(1) Documentation (Standard)
164.316(b)(2)(iii) Updates (Documentation)

SOC 2 · 4 controls

SOC2-CC2.2 COSO principle 14: Internally communicates information including objectives and responsibilities
SOC2-CC3.1 COSO principle 6: Specifies objectives to identify and assess risks
SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
SOC2-CC5.3 COSO principle 12: Deploys control activities through policies and procedures

C5 (Germany) · 3 controls

C5-COM-01 Identification of applicable legal, regulatory, self-imposed or contractual requirements
C5-OIS-01 Information Security Management System (ISMS)
C5-OIS-02 Information Security Policy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-A&A-04 Requirements Compliance
CCM-GRC-05 Information Security Program
CCM-GRC-07 Information System Regulatory Mapping

APEC Cross-Border Privacy Rules (CBPR) System · 2 controls

CBPR-PR-26 Information security policy
CBPR-PR-39 Measures to ensure compliance

Australia Consumer Data Right - Banking (CDR) · 2 controls

AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data
AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment

GDPR · 2 controls

GDPR-Art.24 Responsibility of the controller
GDPR-Art.30 Records of processing activities

ISO 27701:2019 · 2 controls

5.1 General
5.2.3 Determining the scope of the information security management system

NIS2 Directive · 2 controls

Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation
Art.21.2.a Policies on risk analysis and on information system security

NIST SP 800-66 Rev 2 · 2 controls

164.316(a) Policies and Procedures (Standard)
164.316(b)(1) Documentation (Standard)

APRA CPS 230 Operational Risk Management · 1 control

CPS230-P27 Comprehensive Assessment of the Operational Risk Profile

AWS Well-Architected Security Pillar · 1 control

SEC01-BP03 Identify and validate control objectives

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-1 Written security and access policy

Australian Privacy Principles (APPs) · 1 control

APP-1 APP 1 - Open and transparent management of personal information

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-1 Program of Risk Analysis and Oversight

CMMC 2.0 · 1 control

CA.L2-3.12.4 System Security Plan

DORA · 1 control

DORA-Art.6 ICT risk management framework

ISO 22301:2019 · 1 control

4.3.2 Scope of the business continuity management system

ISO/IEC 42001:2023 · 1 control

A.6.2.3 Documentation of AI system design and development

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management

NIST SP 800-161 Rev 1 · 1 control

161R1-PL-2 System Security and Privacy Plans

NIST SP 800-171 Rev 3 · 1 control

03.15.02 System Security Plan

NIST SP 800-172 · 1 control

3.11.4e Security Solution Rationale Document

NIST SP 800-53 Rev 5 · 1 control

NIST800-PL-2 System security and privacy plans

UK Cyber Essentials · 1 control

CE-SCOPE.1 Scope Definition

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.