PL-2—System Security and Privacy Plans

Are consistent with the organization's enterprise architecture;

Explicitly define the constituent system components;

Describe the operational context of the system in terms of mission and business processes;

Identify the individuals that fulfill system roles and responsibilities;

Identify the information types processed, stored, and transmitted by the system;

Provide the security categorization of the system, including supporting rationale;

Describe any specific threats to the system that are of concern to the organization;

Provide the results of a privacy risk assessment for systems processing personally identifiable information;

Describe the operational environment for the system and any dependencies on or connections to other systems or system components;

Provide an overview of the security and privacy requirements for the system;

Identify any relevant control baselines or overlays, if applicable;

Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;

Include risk determinations for security and privacy architecture and design decisions;

Include security- and privacy-related activities affecting the system that require planning and coordination with ⚙organization-defined individuals or groups; and

Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.