Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a question about the guidance in NIST 800-53.
The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information security policies (common controls)? Could the information security plan be considered the information security policy?
Your Information Security Policy is different from your Information Security Plan:
Your Information Security Plan should include all required actions for organization-wide implementation of your Information Security Policy. Although the two are closely tied, they are also separate documents.
A solid Information Security Plan will typically include several phases, depending on your existing infrastructure, network / systems topology and configuration. You may need several distinct technical phases to implement the required security controls without major service disruption. This is entirely subjective, and is up to you, the Security Engineer, to envision.
Note that if compliance with NIST 800-53 is required for your organization, the key word is required: Your organization will be expected to show proof of Due Diligence and implementation of all required items, and as many "suggested" or "recommended" items as technically possible/feasible.
Good luck!
