PL-8 Security and Privacy Architectures
a. Develop security and privacy architectures for the system that: 1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; 2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals; 3. Describe how the architectures are integrated into and support the enterprise architecture; and 4. Describe any assumptions about, and dependencies on, external systems and services; b. Review and update the architectures organization-defined frequency to reflect changes in the enterprise architecture; and c. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.
Source: NIST SP 800-53 Rev 5, PL-8. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.
Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of information security and privacy architecture reviews and updates · Cloud console / configuration management
- Test of Organizational processes for developing, reviewing, and updating the information security and privacy architecture; mechanisms supporting and/or implementing the development, review, and update of the information security and privacy architecture · Cloud console / configuration management
governing documentDocuments that govern the control
- Security and privacy planning policy · Policy repository / GRC workspace
- Procedures addressing information security and privacy architecture development · Policy repository / GRC workspace
- Procedures addressing information security and privacy architecture reviews and updates · Policy repository / GRC workspace
- Enterprise architecture documentation · Policy repository / GRC workspace
- Information security and privacy architecture documentation · Policy repository / GRC workspace
- System security plan · Policy repository / GRC workspace
- Privacy plan · Policy repository / GRC workspace
- Security and privacy CONOPS for the system · Policy repository / GRC workspace
First move
Common gaps auditors find
- No security and privacy architecture describes the approach for protecting information and minimizing privacy risk for the system
- Architecture is not reviewed as the enterprise architecture changes, and planned changes are not reflected in plans or procurements
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPL-7 Concept of Operations · PL-8(1) Security and Privacy Architectures | Defense in Depth