Security and Privacy Architectures PL-8

Planning · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds PL-8 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Planning family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PL-8 (Security and Privacy Architectures) is about writing down how the system is built to protect it: how confidentiality, integrity, and availability are protected, how PII (Personally Identifiable Information) is handled to keep privacy risk low, how it fits the larger enterprise architecture, and what outside systems it depends on. It carries at the Moderate baseline.

What good looks like

Describe how the system protects confidentiality, integrity, and availability.
Explain how PII is processed to keep privacy risk low.
Show how the system fits the enterprise architecture and what outside systems it depends on.
Review and update the architecture as the environment changes.
Carry architecture changes into the security and privacy plans, procedures, and purchases.

Framework mapping

NIST CSF 2.0 — ID.AM-03 — Representations of the organization's authorized network communication and internal and external network data flows are maintained
CIS Controls v8 — Control 12 — Network Infrastructure Management

How to move it toward Implemented

Draw a simple architecture and data-flow diagram for the lab server: what it talks to, in and out, and where any sensitive data sits.
Capture the real picture from the box — listening services with ss -tulpn, addresses and routes with ip a and ip route, and firewall rules with nft list ruleset (or ufw status) — and save it as a dated file.
Note the outside systems it depends on (updates, time, logging) and how each connection is protected.
Keep the diagram in step with the server’s System Security Plan and review it when the setup changes.
Attach that architecture and data-flow description as hardening evidence on the asset, naming PL-8 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.