Critical Infrastructure Plan
LOW MODERATE HIGHRequirements NIST SOURCE
Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.
Discussion (NIST Supplemental Guidance)
Protection strategies are based on the prioritization of critical assets and resources. The requirement and guidance for defining critical infrastructure and key resources and for preparing an associated critical infrastructure protection plan are found in applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PM-8 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- information security issues are addressed in the development of a critical infrastructure and key resources protection plan;
- information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
- information security issues are addressed in the update of a critical infrastructure and key resources protection plan;
- privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;
- privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
- privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.
Examine
[SELECT FROM: Information security program plan; privacy program plan; critical infrastructure and key resources protection plan; procedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan; HSPD 7; National Infrastructure Protection Plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for developing, documenting, and updating the critical infrastructure and key resources protection plan; organizational personnel with information security and privacy responsibilities].
Test
[SELECT FROM: Organizational processes for developing, documenting, and updating the critical infrastructure and key resources protection plan; mechanisms supporting the development, documentation, and updating of the critical infrastructure and key resources protection plan].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PM-8. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Information security program plan
- privacy program plan
- critical infrastructure and key resources protection plan
- procedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan
- National Infrastructure Protection Plan
Testing
- Organizational processes for developing, documenting, and updating the critical infrastructure and key resources protection plan
- mechanisms supporting the development, documentation, and updating of the critical infrastructure and key resources protection plan
Other Records
- HSPD 7
- other relevant documents or records