I have a question about the guidance in NIST 800-53.

The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information security policies (common controls)? Could the information security plan be considered the information security policy?

  • 1
    Have you read the glossary for 800-53?
    – schroeder
    Jan 27, 2015 at 18:28

1 Answer 1


Your Information Security Policy is different from your Information Security Plan:

Your Information Security Plan should include all required actions for organization-wide implementation of your Information Security Policy. Although the two are closely tied, they are also separate documents.

A solid Information Security Plan will typically include several phases, depending on your existing infrastructure, network / systems topology and configuration. You may need several distinct technical phases to implement the required security controls without major service disruption. This is entirely subjective, and is up to you, the Security Engineer, to envision.

Note that if compliance with NIST 800-53 is required for your organization, the key word is required: Your organization will be expected to show proof of Due Diligence and implementation of all required items, and as many "suggested" or "recommended" items as technically possible/feasible.

Good luck!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .