Concept of Operations
LOW MODERATE HIGHRequirements NIST SOURCE
Requirement Context
This element is part of PL-7 — Concept of Operations. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of PL-7 — Concept of Operations. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Discussion (NIST Supplemental Guidance)
The CONOPS may be included in the security or privacy plans for the system or in other system development life cycle documents. The CONOPS is a living document that requires updating throughout the system development life cycle. For example, during system design reviews, the concept of operations is checked to ensure that it remains consistent with the design for controls, the system architecture, and the operational procedures. Changes to the CONOPS are reflected in ongoing updates to the security and privacy plans, security and privacy architectures, and other organizational documents, such as procurement specifications, system development life cycle documents, and systems engineering documents.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PL-7 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- frequency for review and update of the Concept of Operations (CONOPS) is defined;
- a CONOPS for the system describing how the organization intends to operate the system from the perspective of information security and privacy is developed;
- the CONOPS is reviewed and updated <PL-07_ODP frequency>.
Examine
[SELECT FROM: Security and privacy planning policy; procedures addressing security and privacy CONOPS development; procedures addressing security and privacy CONOPS reviews and updates; security and privacy CONOPS for the system; system security plan; privacy plan; records of security and privacy CONOPS reviews and updates; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with security and privacy planning and plan implementation responsibilities; organizational personnel with information security and privacy responsibilities].
Test
[SELECT FROM: Organizational processes for developing, reviewing, and updating the security CONOPS; mechanisms supporting and/or implementing the development, review, and update of the security CONOPS].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PL-7. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Security and privacy planning policy
- system security plan
- privacy plan
Testing
- Organizational processes for developing, reviewing, and updating the security CONOPS
- mechanisms supporting and/or implementing the development, review, and update of the security CONOPS
Other Records
- procedures addressing security and privacy CONOPS development
- procedures addressing security and privacy CONOPS reviews and updates
- security and privacy CONOPS for the system
- records of security and privacy CONOPS reviews and updates
- other relevant documents or records