PL-8 Security and Privacy Architectures

Control statement

a. Develop security and privacy architectures for the system that:
        1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
        2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
        3. Describe how the architectures are integrated into and support the enterprise architecture; and
        4. Describe any assumptions about, and dependencies on, external systems and services;
    b. Review and update the architectures {{ insert: param, pl-08_odp }} to reflect changes in the enterprise architecture; and
    c. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.
        (b) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 2, Appendix F.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators