NIST finalized SP 800-18 Rev. 2 on 30 June 2026. It replaces the 2006 Rev. 1 and covers three "system plans": the system security plan, the system privacy plan and the cybersecurity supply chain risk management plan. If your team keeps a security plan from the old guide, check it against the new outlines.
What the page says changed
The NIST page for Rev. 2 describes the publication as guidance on developing security, privacy and cybersecurity supply chain risk management plans for systems. Per the abstract, the plans describe the system's purpose, the status of its selected controls and the responsibilities of people who manage, support or access it. The aim is that organizations collect the same essential elements of each plan, whatever the mission.
Rev. 1 dated from February 2006 and, per its NIST page, was withdrawn on 30 June 2026. The pages do not list line-by-line changes, so read the full PDF before you rewrite anything.
NIST also links example outlines for the security plan, the privacy plan and the supply chain plan, plus a document on plan-related roles and responsibilities. Start with those outlines instead of a blank page.
How this relates to control PL-2
SP 800-53 already has a control for the plan itself, PL-2. In the Rev. 5 catalog it asks for a plan that, among other things:
- explicitly defines the constituent system components
- describes the operational context in terms of mission and business processes
- identifies the people who fill system roles and responsibilities
- identifies the information types the system processes, stores and transmits
- gives the security categorization with its rationale
- describes the operational environment and any dependencies on or connections to other systems
Think of 800-18 as the guide to writing that document and 800-53 as the control that requires it.
What a software team should do now
- Pull the current plan and note its date and version.
- Download the three example outlines from the NIST page and compare headings.
- Add the plan types you lack. Teams that never wrote a supply chain plan often have the facts in procurement and SBOM records already.
- Name an owner for each plan. A plan nobody owns goes stale in a quarter.
- Link each plan to evidence that can be re-checked, such as an inventory export or a pipeline policy file.
Keep the plan short and true. A plan that claims a control is in place when it is only planned is worse than one that says "planned, owner, date."
Do you need to do this at all
Only if a contract, an agency sponsor or your own program asks for system plans. Many small vendors never write one. If you sell into a program that uses 800-53 controls, expect to be asked. Check the actual requirement before spending time.
Try it yourself
The framework mapping demo shows how a single piece of evidence supports several controls. Click a control and look for how many plan sections the same record can feed.
Click through it at your own pace, or open it full screen.
Quick check
Is SP 800-18 Rev. 1 still current?
No. The NIST page lists it as withdrawn on 30 June 2026 and superseded by Rev. 2.
Which plans does Rev. 2 cover?
The system security plan, the system privacy plan and the cybersecurity supply chain risk management plan.
Safeguard's compliance and evidence automation can hold the records that back these plans, and its asset discovery and SBOM scanning feed the component list. A free scan is at gold.safeguard.sh/scan.
Sources
- NIST SP 800-18 Rev. 2
- NIST SP 800-18 Rev. 1
- NIST SP 800-53 Rev. 5 catalog, control PL-2 (OSCAL content)
Last reviewed: 19 October 2026.
