Rev. 3 planning requirements, a family new in Rev. 3: the policies and procedures behind the requirements, the system security plan and rules of behavior for system users.
Developing, documenting and disseminating the policies and procedures needed to meet the security requirements and reviewing them at a defined frequency; new in Rev. 3 and drawn from the policy and procedures control of 17 SP 800-53 families.
Writing and maintaining the system security plan: components, information types, threats, operating environment and connections, requirements, safeguards in place or planned and system roles, reviewed at a defined frequency and protected. Rev. 2's 3.12.4 moved here.
Establishing rules of behavior for system use and protecting CUI, giving them to people who need access, getting documented acknowledgment before granting access and reviewing them at a defined frequency; new in Rev. 3.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.