NIST SP 800-53 Rev 5 MODERATE
PL Planning

NIST SP 800-53 Rev 5 MODERATE PL-2: System Security and Privacy Plans

Develop SSP that aligns with FedRAMP template; review and update annually.

What else in your programme already covers this

This control maps to 57 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 6 controls

  • 12.1.1 An overall information security policy is: • Established. • Published. • Maintained. • Disseminated to all relevant personnel, as well as to relevant vendors and business partners
  • 12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
  • 12.5.2 PCI DSS scope documented and confirmed annually
  • 12.5.2.1 Service provider scope confirmed every 6 months
  • 12.8.5 Responsibility matrix with TPSPs
  • 2.1.1 All security policies and operational procedures that are identified in Requirement 2 are: • Documented. • Kept up to date. • In use. • Known to all affected parties

ISO 27001:2022 · 5 controls

  • 5.1 Policies for information security
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 5.37 Documented operating procedures
  • 5.8 Information security in project management

ISO 27002:2022 · 5 controls

  • 5.1 Policies for information security
  • 5.2 Information security roles and responsibilities
  • 5.35 Independent review of information security
  • 5.37 Documented operating procedures
  • 5.8 Information security in project management

HIPAA Security Rule · 4 controls

SOC 2 · 4 controls

  • SOC2-CC2.2 COSO principle 14: Internally communicates information including objectives and responsibilities
  • SOC2-CC3.1 COSO principle 6: Specifies objectives to identify and assess risks
  • SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
  • SOC2-CC5.3 COSO principle 12: Deploys control activities through policies and procedures

C5 (Germany) · 3 controls

  • C5-COM-01 Identification of applicable legal, regulatory, self-imposed or contractual requirements
  • C5-OIS-01 Information Security Management System (ISMS)
  • C5-OIS-02 Information Security Policy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

APEC Cross-Border Privacy Rules (CBPR) System · 2 controls

Australia Consumer Data Right - Banking (CDR) · 2 controls

  • AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data
  • AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment

GDPR · 2 controls

ISO 27701:2019 · 2 controls

  • 5.1 General
  • 5.2.3 Determining the scope of the information security management system

NIS2 Directive · 2 controls

  • Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation
  • Art.21.2.a Policies on risk analysis and on information system security

NIST SP 800-66 Rev 2 · 2 controls

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P27 Comprehensive Assessment of the Operational Risk Profile

AWS Well-Architected Security Pillar · 1 control

  • SEC01-BP03 Identify and validate control objectives

Australia My Health Records Act 2012 · 1 control

Australian Privacy Principles (APPs) · 1 control

  • APP-1 APP 1 - Open and transparent management of personal information

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-1 Program of Risk Analysis and Oversight

CMMC 2.0 · 1 control

DORA · 1 control

ISO 22301:2019 · 1 control

  • 4.3.2 Scope of the business continuity management system

ISO/IEC 42001:2023 · 1 control

  • A.6.2.3 Documentation of AI system design and development

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-172 · 1 control

  • 3.11.4e Security Solution Rationale Document

NIST SP 800-53 Rev 5 · 1 control

UK Cyber Essentials · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PL Planning

Query this from an agent

The graph holds this control, the 57 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 MODERATE controls