{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Governance, Policy & Oversight","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-18","description":"Develop, approve, and maintain security and privacy plans for systems that describe each system's authorized purpose, boundary, operating context and concept of operations, requirements, and the controls in place or planned. Distribute plans to authorized personnel, protect them from unauthorized disclosure and modification, review them at defined intervals, and update them to address changes — verifying that systems continue to be used only for their intended and authorized purposes.","details":{"control_category":"administrative","control_type":"preventive","domain":"Governance, Policy & Oversight","guidance":[],"members":[{"control_id":"PL-2","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"PL-7","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"PM-32","coverage":"full","framework":"nist-800-53","relationship":"superset_of"}],"statement":"Develop, approve, and maintain security and privacy plans for systems that describe each system's authorized purpose, boundary, operating context and concept of operations, requirements, and the controls in place or planned. Distribute plans to authorized personnel, protect them from unauthorized disclosure and modification, review them at defined intervals, and update them to address changes — verifying that systems continue to be used only for their intended and authorized purposes.","title":"Document and approve system security and privacy plans","unified_id":"UC-GOV-18"},"id":"uc:UC-GOV-18","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-18","sourceIds":["nist-800-53"],"sourceUrl":null,"title":"UC-GOV-18 — Document and approve system security and privacy plans","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2c3e20ed5fcf27ed6f8116af3fccee3c07e168c7c739011a9479932db24ddef9","properties":{"rationale":"Maintained, approved system security plans keep each system's control set defined and current.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-18-680359d2.json","sourceId":"uc:UC-GOV-18","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2d426686837ee3a83ab5d4eb309b160dd1831dba8ed91202530b257de1e922b2","properties":{},"sourceDetailPath":"/data/v1/records/wf-c24-000b9f1d.json","sourceId":"wf:C24","targetDetailPath":"/data/v1/records/uc-uc-gov-18-680359d2.json","targetId":"uc:UC-GOV-18","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7dcbc5d8ababa03787fca4cc0279554364da6e4ddc85dd65043578759f36f22c","properties":{"control_id":"PL-7","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-18-680359d2.json","sourceId":"uc:UC-GOV-18","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pl-7-83b81ba7.json","targetId":"ctrl:nist-800-53:PL-7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:afa13be3fd5de5f31b6717b5b3a140623368d158a9c4b5ddd9865ee54c616bf3","properties":{"control_id":"PM-32","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-18-680359d2.json","sourceId":"uc:UC-GOV-18","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pm-32-a780e129.json","targetId":"ctrl:nist-800-53:PM-32","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b7cb500133cf6ea14dfa45dac891038ee299b950d23faba86465082574141cb0","properties":{"control_id":"PL-2","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-18-680359d2.json","sourceId":"uc:UC-GOV-18","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pl-2-02fe0a73.json","targetId":"ctrl:nist-800-53:PL-2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fe2957ce765e5a57e0909a847061718ef86bdf9a97229035ad1a67b34ee9e93d","properties":{},"sourceDetailPath":"/data/v1/records/wf-c8-5634a289.json","sourceId":"wf:C8","targetDetailPath":"/data/v1/records/uc-uc-gov-18-680359d2.json","targetId":"uc:UC-GOV-18","type":"oversees"}],"schemaVersion":1}