NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PL-3, System Security Plan Update, is marked withdrawn in Rev 5. The catalog records that it was incorporated into PL-2.
Older templates and some customer questionnaires still use the ID, so you may be asked about it.
What it means in practice
The idea has not gone away. PL-2 now carries the duty to review and update the plan, and to distribute and protect the updated version. When PL-3 comes up, you answer from PL-2.
Evidence to collect
- Plan version history with dates and change notes.
- The update triggers you defined.
- Approval after each significant update.
Common gaps
- Treating the withdrawn control as not applicable and showing nothing.
- Version history that lists dates but no reasons.
How to implement it
Keep a change log at the top of the plan. Record the trigger and approver each time. In questionnaires, state that PL-3 is withdrawn and point to PL-2 evidence. Do not rely on a framework mapping that still cites the old ID without checking it.
Quick check
Where do I answer PL-3 now?
Under PL-2, which covers review, update, and protection of the plan.
