PL-1 Policy and procedures
The planning policy and procedures control: what the PL policy must address, who owns it, review and update cycles for policy and procedures, and the documents assessors examine.
PL Planning
The SP 800-53 Rev. 5 Planning family: planning policy, system security and privacy plans, rules of behavior, concept of operations, architectures, central management, and baseline selection and tailoring.
PL-2 System security and privacy plans
The system security and privacy plans: the 15 content elements the control lists, approval by the authorizing official, distribution, periodic review, updates and protection. Its SP 800-53A procedure has more determination statements than any other base control in the catalog.
PL-4 Rules of behavior
Rules of behavior for system users: establishing them, collecting a documented acknowledgment before access, periodic review, and re-acknowledgment after changes, with social media and external site restrictions as an enhancement.
PL-7 Concept of operations
The concept of operations (CONOPS) describing how the organization intends to operate the system from a security and privacy perspective, kept up to date over the system life cycle. No SP 800-53B baseline includes it.
PL-8 Security and privacy architectures
System security and privacy architectures: the protection approach, PII processing, fit with the enterprise architecture (PM-7), external dependencies, and keeping plans and acquisitions aligned, with defense in depth and supplier diversity as enhancements.
PL-9 Central management
Central management of selected controls and related processes across the organization, covering planning, implementing, assessing, authorizing and monitoring them centrally. It is in the privacy baseline but no security baseline.
PL-10 Baseline selection
Selecting a control baseline for the system, such as one of the federal baselines in SP 800-53B, which derive from FISMA and the Privacy Act, as the starting point that PL-11 tailoring then adjusts.
PL-11 Baseline tailoring
Tailoring the selected control baseline: identifying common controls, applying scoping considerations, choosing compensating controls, assigning parameter values, supplementing with extra controls and adding implementation detail, as set out in SP 800-53B.
