PL-2 PL-2 (a) High High High The organization conducting eMASS SSP Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the documented security plan to ensure the organization being inspected/assessed develops a security plan for the information system. PL-2 PL-2 (a) (1) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the security plan and the enterprise architecture to ensure the organization's security plan for the information system is consistent with the organization's enterprise architecture. PL-2 PL-2 (a) (2) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the security plan to ensure the organization being inspected/assessed explicitly defines within the security plan the authorization boundary for the system. PL-2 PL-2 (a) (3) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the security plan to ensure the organization inspected/assessed describes within the security plan the operational context of the information system in terms of missions and business processes. PL-2 PL-2 (a) (4) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the security plan to ensure the organization being inspected/assessed defines within the security plan the security categorization of the information system including supporting rationale. PL-2 PL-2 (a) (5) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the security plan to ensure the organization being inspected/assessed describes within the security plan the operational environment for the information system and relationships with or connections to other information systems.
PL-2 PL-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented security plan to ensure the organization being inspected/assessed develops a security plan for the information system. eMASS SSP PL-2 PL-2 (a) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan and the enterprise architecture to ensure the organization's security plan for the information system is consistent with the organization's enterprise architecture. eMASS SSP PL-2 PL-2 (a) (2) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed explicitly defines within the security plan the authorization boundary for the system. eMASS SSP PL-2 PL-2 (a) (3) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization inspected/assessed describes within the security plan the operational context of the information system in terms of missions and business processes. eMASS SSP PL-2 PL-2 (a) (4) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed defines within the security plan the security categorization of the information system including supporting rationale. eMASS SSP PL-2 PL-2 (a) (5) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed describes within the security plan the operational environment for the information system and relationships with or connections to other information systems. eMASS SSP
RMF_Security-Planning.docx