PM-8, Critical Infrastructure Plan, says to address information security and privacy issues in developing, documenting and updating a critical infrastructure and key resources protection plan. It is a federal program control and applies mainly to agencies and contractors in the critical infrastructure sectors. For other companies it is a prompt to ask what you must keep running.
What it means in practice
The record says protection strategies are based on prioritizing critical assets and resources. The definition of critical infrastructure and the plan requirements come from applicable laws, executive orders, directives and policies, not from 800-53 itself.
A company outside those sectors can still run the exercise: list the services and assets that matter most, and make sure your security and privacy requirements are written into the plan that protects them.
Evidence to collect
- The critical infrastructure protection plan, where one is required
- Evidence that security and privacy staff contributed to it
- A ranked list of critical assets and services
- Review and update dates
Common gaps
- The plan was written by operations without security input
- The asset ranking has not been updated since the last reorg
- Nobody knows whether the company counts as critical infrastructure for a customer
How to implement it
- Ask counsel or your contracts team which laws or customer terms define critical assets for you.
- Rank assets by business impact and write the ranking down.
- Add a security and privacy review to each plan update.
Quick check
Where does the definition of critical infrastructure come from?
From applicable laws, executive orders, directives and policies named in the record, not from the control text itself.
