IAO-09: Applied Security, Compliance and Resilience Controls Documentation
Mechanisms exist to generate authoritative documentation (e.g., System Security Plan (SSP)) that: (1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS); (2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and (3) Provides a historical record of applied security controls, including changes.
Renumbered: Formerly IAO-03 in SCF 2025.4.
Control Question: Does the organization generate authoritative documentation (e.g., System Security Plan (SSP)) that: (1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS); (2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and (3) Provides a historical record of applied security controls, including changes?
General (31)
| Framework | Mapping Values |
|---|---|
| AICPA TSC 2017:2022 (used for SOC 2) (source) | CC2.2-POF11 CC2.3-POF9 CC2.3-POF10 CC2.3-POF11 |
| GovRAMP | PL-02 |
| GovRAMP Low | PL-02 |
| GovRAMP Low+ | PL-02 |
| GovRAMP Moderate | PL-02 |
| GovRAMP High | PL-02 |
| ISO/SAE 21434 2021 | RQ-06-05 RQ-06-05(a) RQ-06-05(b) RQ-06-06 RQ-06-07 RQ-06-08 RQ-06-10 RQ-06-11 RQ-06-18 RQ-06-23 RQ-09-01(a) RQ-09-01(b) RQ-09-01(c) RQ-09-02 RQ-09-08 RQ-09-08(a) RQ-09-08(b) RQ-09-09 RQ-09-10 RQ-09-11 RQ-09-11(a) RQ-09-11(b) RQ-12-01 RQ-12-02 RQ-12-02(a) RQ-12-02(b) RQ-12-02(c) RQ-12-02(d) RQ-12-03 |
| NIST AI 100-1 (AI RMF) 1.0 | MANAGE 4.0 |
| NIST 800-37 R2 | TASK C-1 TASK S-4 TASK S-5 TASK S-6 |
| NIST 800-53 R4 | PL-2 |
| NIST 800-53 R5.2 | PL-02 |
| NIST 800-53B R5 (low) (source) | PL-02 |
| NIST 800-53B R5 (moderate) (source) | PL-02 |
| NIST 800-53B R5 (high) (source) | PL-02 |
| NIST 800-53B R5 (privacy) (source) | PL-02 |
| NIST 800-82 R3 | PL-02 |
| NIST 800-82 R3 LOW OT Overlay | PL-02 |
| NIST 800-82 R3 MODERATE OT Overlay | PL-02 |
| NIST 800-82 R3 HIGH OT Overlay | PL-02 |
| NIST 800-161 R1 | PL-2 |
| NIST 800-161 R1 C-SCRM Baseline | PL-2 |
| NIST 800-161 R1 Flow Down | PL-2 |
| NIST 800-161 R1 Level 3 | PL-2 |
| NIST 800-171 R2 (source) | 3.12.4 |
| NIST 800-171 R3 (source) | 03.01.16.a 03.04.11.a 03.04.11.b 03.15.02.a 03.15.02.a.01 03.15.02.a.02 03.15.02.a.03 03.15.02.a.04 03.15.02.a.05 03.15.02.a.06 03.15.02.a.07 03.15.02.a.08 03.15.02.b |
| NIST 800-171A (source) | 3.12.4[a] 3.12.4[b] 3.12.4[c] 3.12.4[d] 3.12.4[e] 3.12.4[f] 3.12.4[g] 3.12.4[h] |
| NIST 800-171A R3 (source) | A.03.01.16.a[01] A.03.04.11.a[02] A.03.04.11.a[03] A.03.04.11.b[01] A.03.04.11.b[02] A.03.15.02.ODP[01] A.03.15.02.a.01 A.03.15.02.a.02 A.03.15.02.a.03 A.03.15.02.a.04 A.03.15.02.a.05 A.03.15.02.a.06 A.03.15.02.a.07 A.03.15.02.a.08 A.03.15.02.b[01] A.03.15.02.b[02] |
| NIST 800-172 R3 | 03.01.04E 03.01.06E 03.13.11E 03.13.14E 03.13.16E 03.14.08E 03.14.10E 03.14.14E 03.14.15E 03.14.16E 03.15.01E 03.15.02E 03.15.03E 03.16.01E 03.17.02E |
| NIST 800-172A R3 | A.03.01.04E.ODP[02] DS-A.03.01.06E A.03.13.11E.ODP[01] A.03.13.14E.ODP[01] A.03.13.16E.ODP[03] A.03.14.08E.ODP[01] A.03.14.08E.ODP[03] A.03.14.08E.ODP[05] A.03.14.08E.ODP[07] A.03.14.08E.ODP[11] A.03.14.10E.ODP[02] A.03.14.14E.ODP[01] A.03.14.15E.ODP[01] A.03.14.16E.ODP[01] DS-A.03.15.01E.a.01 DS-A.03.15.01E.a.03 DS-A.03.15.01E.b DS-A.03.15.01E.c DS-A.03.15.02E.b A.03.15.02E.ODP[01] A.03.15.03E.ODP[01] A.03.15.03E.ODP[02] A.03.16.01E.ODP[02] A.03.17.02E.ODP[01] |
| NIST Privacy Framework 1.0 | ID.IM-P7 ID.BE-P3 |
| SCF DPMP 2026 | 5.13 |
US (20)
| Framework | Mapping Values |
|---|---|
| USA Federal CMS MARS-E 2.0 | PL-2 PL-2.a PL-2.a.1 PL-2.a.2 PL-2.a.3 PL-2.a.4 PL-2.a.5 PL-2.a.6 PL-2.a.7 PL-2.a.8 PL-2.a.9 PL-2.b PL-2.c PL-2.d PL-2.d.1 PL-2.d.2 PL-2.d.3 PL-2.d.4 PL-2.d.5 PL-2.e PL-2-IS PL-2(3) |
| USA Federal DoW BaTB OT 2026 | 10 |
| USA Federal CMMC 2.0 Level 2 | CAL2.-3.12.4 |
| USA Federal CMMC 2.0 Level 3 | RA.L3-3.11.4E |
| USA Federal NNPI (unclass) 2010 | 11-3.a(2)(b)3 11-3.b(3) |
| USA Federal CJIS Security Policy 6.0 | PL-2 |
| USA Federal 21 CFR Part 11 2025 | 11.30 |
| USA Federal FedRAMP R5 (low) | PL-02 |
| USA Federal FedRAMP R5 (moderate) | PL-02 |
| USA Federal FedRAMP R5 (high) | PL-02 |
| USA Federal FedRAMP R5 (LI-SaaS) | PL-02 |
| USA Federal IRS 1075 2021 | 2.E.4.3 2.E.4.3-1.1 2.E.4.3-1.2 2.E.4.3-1.3 2.E.4.3-1.4 2.E.4.3-1.5 2.E.4.3-2.1 2.E.4.3-2.2 2.E.4.3-2.3 2.E.4.3-2.4 2.E.6.1-1 2.E.6.1-2 2.E.6.1-3 2.E.6.1-4 PL-2 PL-2(IRS-Defined) |
| USA Federal 33 CFR Part 101 Subpart F | 101.625(d)(5) 101.630(a) 101.630(c) 101.630(c)(1) 101.630(c)(2) 101.630(c)(3) 101.630(c)(4) 101.630(c)(5) 101.630(c)(6) 101.630(c)(7) 101.630(c)(8) 101.630(c)(9) 101.630(c)(10) 101.630(c)(11) 101.630(c)(12) 101.630(c)(13) 101.630(c)(14) 101.650(c) 101.650(e)(1)(v) |
| USA Federal NRC 10 CFR 73.54 2015 | 73.54 73.54(e) 73.54(e)(1) 73.54(e)(2) |
| USA Federal NSF RIG 2025 | 5.3.1 5.3.5 |
| USA Federal TSA SDP 2021-02F | II.B.1 |
| USA Federal TSA / DHS 1580/82-2022-01 | III.B.2 III.B.2.a III.B.2.b |
| USA Texas DIR SCSC 2.2 2025 | PL-02 |
| USA Texas TX-RAMP Level 1 | PL-02 |
| USA Texas TX-RAMP Level 2 | PL-02 |
EMEA (11)
| Framework | Mapping Values |
|---|---|
| EMEA Germany BAIT 2017 | 3.6 |
| EMEA Germany C5 2026 | OIS-01.02B OIS-01.02B.2 OIS-01.03B OPS-32.01B.3 |
| EMEA Spain Royal Decree 311 2022 | Article 12(1)(e) Article 15(2) |
| EMEA EU AI Act | Article 11.1 |
| EMEA EU Cyber Resiliency Act 2024 | Article 13(2) Article 13(3) Article 13(7) Article 19(2)(b) Article 31(1) Article 31(2) Article 31(3) |
| EMEA EU EBA GL/2019/04 | 3.4.6.42 3.6.2.69 3.6.2.70 |
| EMEA UK CAP 1850 2020 | A2 A3 B1 B4 |
| EMEA UK DEFSTAN 05-138 2024 | 2301 |
| EMEA UK DEFSTAN 05-138 - L2 2024 | 2301 |
| EMEA UK DEFSTAN 05-138 - L3 2024 | 2301 |
| EMEA Saudi Arabia CSCC-1 2019 | 2-13-4 |
APAC (5)
| Framework | Mapping Values |
|---|---|
| APAC Australia CCM 2026 | GOV-06 GOV-10 IDE-04 |
| APAC Australia ISM June 2026 | ISM-0041 ISM-0432 ISM-0912 ISM-1912 ISM-2005 |
| APAC Japan ISMAP | 4.4.4 4.4.5.2 |
| APAC New Zealand NZISM 3.9 | 3.4.12.C.01 3.4.12.C.02 4.3.17.C.01 4.3.18.C.01 4.3.18.C.02 4.3.18.C.03 4.3.18.C.04 4.3.18.C.05 5.1.8.C.01 5.1.9.C.01 5.1.10.C.01 5.4.5.C.01 5.4.5.C.02 5.4.5.C.03 |
| APAC Singapore Cyber Hygiene Practice 2019 | 4.3(a) |
Americas (2)
| Framework | Mapping Values |
|---|---|
| Americas Argentina Reg 132 2018 | B.2.1-1 E.1.1-3 |
| Americas Canada ITSP-10-171 2025 | 03.01.16.A 03.04.11.A 03.04.11.B 03.15.02.A 03.15.02.A.01 03.15.02.A.02 03.15.02.A.03 03.15.02.A.04 03.15.02.A.05 03.15.02.A.06 03.15.02.A.07 03.15.02.A.08 03.15.02.B |
Capability Maturity Model
Level 0 — Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 — Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 — Planned & Tracked
Information Assurance (IAO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Information Assurance (IA)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ IA management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IT and/or cybersecurity personnel implement and maintain a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/or contractual requirements for pre-production cybersecurity and data protection control testing. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop and maintain System Security Plans (SSPs) or similar documentation, to identify and maintain key architectural information for each business-critical Technology Assets, Applications and/or Services (TAAS).
Level 3 — Well Defined
Information Assurance (IAO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with IAO domain capabilities are well-documented and kept current by process owners. ▪ An information assurance team, or similar function, is appropriately staffed and supported to implement and maintain IAO domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of information assurance operations (e.g., assessment scheduling software and risk assessment software). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to generate authoritative documentation (e.g., System Security Plan (SSP)) that: (1) Identifies key architectural and implementation information on in-scope Technology Assets, Applications and/or Services (TAAS); (2) Reflects the current state of applied security, compliance and resilience controls on applicable People, Processes, Technologies, Data and/or Facilities (PPTDF) that are contained within the system boundary; and (3) Provides a historical record of applied security controls, including changes.
Level 4 — Quantitatively Controlled
Information Assurance (IAO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 — Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Assessment Objectives
- IAO-09_A01 the system boundary is described and documented in the system security plan.
- IAO-09_A02 the system components on which sensitive / regulated data is processed are identified and documented.
- IAO-09_A03 the system components on which sensitive / regulated data is stored are identified and documented.
- IAO-09_A04 changes to the system or system component location where sensitive / regulated data is processed are documented.
- IAO-09_A05 changes to the system or system component location where sensitive / regulated data is stored are documented.
- IAO-09_A06 a system security plan that describes specific threats to the system that are of concern to the organization is developed.
- IAO-09_A07 a system security plan that describes the safeguards in place or planned for meeting the security requirements is developed.
- IAO-09_A08 a system security plan that identifies individuals that fulfill system roles and responsibilities is developed.
- IAO-09_A09 a System Security Plan (SSP) is developed that documents the additional information necessary for the protection of sensitive / regulated data.
- IAO-09_A10 the system security plan is reviewed per an organization-defined frequency.
- IAO-09_A11 the system security plan is protected from unauthorized disclosure.
- IAO-09_A12 the security requirements identified and approved by the designated authority as non-applicable are identified.
- IAO-09_A13 the method of security requirement implementation is described and documented in the system security plan.
- IAO-09_A14 the relationship with or connection to other systems is described and documented in the system security plan.
- IAO-09_A15 the system security plan documents or references the security solution selected.
- IAO-09_A16 the system security plan documents or references the rationale for the security solution.
- IAO-09_A17 the system security plan documents or references the risk determination.
- IAO-09_A18 individuals or groups with whom cybersecurity / data privacy-related activities affecting the system that require planning and coordination is/are assigned.
- IAO-09_A19 personnel or roles to receive distributed copies of the system cybersecurity / data privacy plans is/are assigned.
- IAO-09_A20 the frequency at which the system security plan is reviewed and updated is defined.
- IAO-09_A21 the system security plan is updated per an organization-defined frequency.
- IAO-09_A22 a security plan for the system is developed that is consistent with the organization's enterprise architecture.
- IAO-09_A23 a privacy plan for the system is developed that is consistent with the organization's enterprise architecture.
- IAO-09_A24 a system security plan that defines the constituent system components is developed.
- IAO-09_A25 a privacy plan for the system is developed that explicitly defines the constituent system components.
- IAO-09_A26 a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes.
- IAO-09_A27 a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes.
- IAO-09_A28 a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities.
- IAO-09_A29 a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities.
- IAO-09_A30 a system security plan that identifies the information types processed, stored, and transmitted by the system is developed.
- IAO-09_A31 a privacy plan for the system is developed that identifies the information types processed, stored and transmitted by the system.
- IAO-09_A32 a security plan for the system is developed that provides the security categorization of the system, including supporting rationale.
- IAO-09_A33 a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale.
- IAO-09_A34 a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization.
- IAO-09_A35 a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization.
- IAO-09_A36 a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing Personal Data (PD).
- IAO-09_A37 a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing Personal Data (PD).
- IAO-09_A38 a system security plan that describes the operational environment for the system and any dependencies on or connections to other systems or system components is developed.
- IAO-09_A39 a system security plan that provides an overview of the security requirements for the system is developed.
- IAO-09_A40 a privacy plan for the system is developed that provides an overview of the privacy requirements for the system.
- IAO-09_A41 a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable.
- IAO-09_A42 a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable.
- IAO-09_A43 a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions.
- IAO-09_A44 a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions.
- IAO-09_A45 a security plan for the system is developed that includes risk determinations for security architecture and design decisions.
- IAO-09_A46 a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions.
- IAO-09_A47 a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with individuals or groups.
- IAO-09_A48 a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with individuals or groups.
- IAO-09_A49 a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
- IAO-09_A50 a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
- IAO-09_A51 copies of the plans are distributed to personnel or roles.
- IAO-09_A52 subsequent changes to the plans are communicated to personnel or roles.
- IAO-09_A53 plans are reviewed frequently.
- IAO-09_A54 plans are updated to address changes to the system and environment of operations.
- IAO-09_A55 plans are updated to address problems identified during the plan implementation.
- IAO-09_A56 plans are updated to address problems identified during control assessments.
- IAO-09_A57 plans are protected from unauthorized disclosure.
- IAO-09_A58 plans are protected from unauthorized modification.
- IAO-09_A59 the system components on which CUI is stored are identified and documented.
- IAO-09_A60 the system components on which CUI is stored are identified and documented.
- IAO-09_A61 changes to the system or system component location where CUI is processed are documented.
- IAO-09_A62 changes to the system or system component location where CUI is stored are documented.
- IAO-09_A63 a system security plan that includes other relevant information necessary for the protection of CUI is developed.
- IAO-09_A64 the system security plan is reviewed <A.03.15.02.ODP[01]: frequency>.
- IAO-09_A65 the system security plan is updated <A.03.15.02.ODP[01]: frequency>.
Evidence Requirements
- E-TDA-14 System Security Plan (SSP)
-
Documented evidence of at least one (1) System Security Plan (SSP) that covers the sensitive/regulated data environment. There may be multiple SSPs, based on applicable contracts.
Technology Design & Acquisition - E-TDA-18 System Security Plan (SSP) Reviews
-
Documented evidence of reviews and/or updates to System Security Plan (SSP) documentation.
Technology Design & Acquisition
Technology Recommendations
Micro/Small
- System Security Plan (SSP)
- System Security & Privacy Plan (SSPP)
Small
- System Security Plan (SSP)
- System Security & Privacy Plan (SSPP)
Medium
- System Security Plan (SSP)
- System Security & Privacy Plan (SSPP)
Large
- System Security Plan (SSP)
- System Security & Privacy Plan (SSPP)
Enterprise
- System Security Plan (SSP)
- System Security & Privacy Plan (SSPP)