[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-174131-105":53,"doc-detail-174131-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","security-plan-history-sensitive-system-specific-security-plan-history","SECURITY PLAN HISTORY - Sensitive System Specific - SECURITY PLAN HISTORY","","Security Plan History template for a sensitive IT system, defining required governance artifacts, inventories, and security control implementation evidence. It guides agencies to compile system inventory and application inventory for CSRM GRC, document data set classification across confidentiality, integrity, and availability, and complete business impact analysis for dependent business processes. It also prompts creation of system boundary and information flow diagrams, and specifies how to apply the SEC530 security control catalog by recording implementation status and detailed strategies to meet requirements.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/security-plan-history-sensitive-system-specific-security-plan-history/174131/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/security-plan-history-sensitive-system-specific-security-plan-history/174131.png","ImageObject",442,249,{"name":88,"@type":89},"Arica Lee","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/vnd.openxmlformats-officedocument.wordprocessingml.document","2026-10-22","2026-09-02",true,{"@type":98,"interactionType":99,"userInteractionCount":15},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the purpose of the data set classification inventory in this security plan?","Question",{"text":108,"@type":109},"It summarizes data types in the system’s data set inventory and determines whether the system is sensitive based on confidentiality, integrity, and availability criteria. Documentation is required when the determination is “non-sensitive.”","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How should system and application inventory information be submitted?",{"text":113,"@type":109},"Complete the application inventory template so the information can be populated into the CSRM GRC application. Submit the completed inventory spreadsheet to CommonwealthSecurity@VITA.Virginia.Gov.",{"name":115,"@type":106,"acceptedAnswer":116},"How is the SEC530 security control catalog expected to be used?",{"text":117,"@type":109},"For each SEC530 control, indicate the implementation status and describe the detailed implementation strategy—how the control is met for the specific IT system.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},174131,1791305259,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":15,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},8796096645457,"https://ap-avatar.wpscdn.com/avatar/800003749518d68ffe3?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779345340919836971","[AGENCY]\n[SYSTEM]\nSecurity Plan\nSensitive System Specific\n[DATE]\nAUTHORIZED BY:\n[Agency ISO]\t\t\t\t\t\t\t\t\tDate\n[Agency Head Name and Title]\t\t\t\t\t\t\tDate\n[Additional Authorizer Name and Title]\t\t\t\t\tDate\nSECURITY PLAN HISTORY\nCONTENTS\n\u0013 TOC \\o \"1-1\" \\h \\z \\u \u0014\u0013 HYPERLINK \\l \"_Toc156907160\" \u0014SECURITY PLAN HISTORY\t\u0013 PAGEREF _Toc156907160 \\h \u00141\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907161\" \u0014CONTENTS\t\u0013 PAGEREF _Toc156907161 \\h \u00141\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907162\" \u0014EXECUTIVE SUMMARY\t\u0013 PAGEREF _Toc156907162 \\h \u00142\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907163\" \u0014SYSTEM INVENTORY & DEFINITION\t\u0013 PAGEREF _Toc156907163 \\h \u00142\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907164\" \u0014DATA SET CLASSIFICATION INVENTORY\t\u0013 PAGEREF _Toc156907164 \\h \u00142\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907165\" \u0014BUSINESS PROCESSES\t\u0013 PAGEREF _Toc156907165 \\h \u00142\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907166\" \u0014SYSTEM BOUNDARY DIAGRAM\t\u0013 PAGEREF _Toc156907166 \\h \u00142\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907167\" \u0014INFORMATION FLOW DIAGRAM\t\u0013 PAGEREF _Toc156907167 \\h \u00143\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907168\" \u0014CSRM RESOURCES\t\u0013 PAGEREF _Toc156907168 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907169\" \u0014ITRM-SEC530 CONTROLS\t\u0013 PAGEREF _Toc156907169 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907170\" \u0014AC – ACCESS CONTROL\t\u0013 PAGEREF _Toc156907170 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907171\" \u0014AU - AUDIT AND ACCOUNTABILITY\t\u0013 PAGEREF _Toc156907171 \\h \u001420\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907172\" \u0014CA - SECURITY ASSESSMENT AND AUTHORIZATION\t\u0013 PAGEREF _Toc156907172 \\h \u001427\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907173\" \u0014CM – CONFIGURATION MANAGEMENT\t\u0013 PAGEREF _Toc156907173 \\h \u001429\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907174\" \u0014IA – IDENTIFICATION AND AUTHENTICATION\t\u0013 PAGEREF _Toc156907174 \\h \u001434\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907175\" \u0014IR – INCIDENT RESPONSE\t\u0013 PAGEREF _Toc156907175 \\h \u001444\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907176\" \u0014MA – MAINTENANCE\t\u0013 PAGEREF _Toc156907176 \\h \u001446\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907177\" \u0014PE – PHYSICAL AND ENVIRONMENTAL PROTECTION\t\u0013 PAGEREF _Toc156907177 \\h \u001448\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907178\" \u0014PL – PLANNNING\t\u0013 PAGEREF _Toc156907178 \\h \u001450\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907179\" \u0014RA – RISK ASSESSMENT\t\u0013 PAGEREF _Toc156907179 \\h \u001451\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907180\" \u0014SA – SYSTEM AND SERVICES ACQUISITION\t\u0013 PAGEREF _Toc156907180 \\h \u001451\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907181\" \u0014SC – SYSTEM AND COMMUNICATION PROTECTION\t\u0013 PAGEREF _Toc156907181 \\h \u001471\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907182\" \u0014SI – SYSTEM AND INFORMATION INTEGRITY\t\u0013 PAGEREF _Toc156907182 \\h \u001496\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc156907183\" \u0014POAM/Remediation Plan Template\t\u0013 PAGEREF _Toc156907183 \\h \u0014110\u0015\u0015\n\u0015\u000f\nEXECUTIVE SUMMARY\n[Please provide an executive summary of the System Security Plan here]\nSYSTEM INVENTORY & DEFINITION\nPlease use the template located at the following URL to complete the application inventory template.  Follow the instructions on the tab labeled “Instructions”.  This application information will be populated into the Commonwealth Security and Risk Management (CSRM) governance, risk, and compliance (GRC) application.  Upon completion, send the completed inventory spreadsheet to \u0013 HYPERLINK \"mailto:CommonwealthSecurity@VITA.Virginia.Gov\" \u0014CommonwealthSecurity@VITA.Virginia.Gov\u0015\n\u0013 HYPERLINK \"https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.vita.virginia.gov%2Fmedia%2Fvitavirginiagov%2Fcommonwealth-security%2Fdocs%2FApplication-Template.xlsm&wdOrigin=BROWSELINK\" \u0014Application-Template.xlsm (live.com)\u0015\n[Attach the System Inventory as an appendix to the SSP or insert file object here]\nDATA SET CLASSIFICATION INVENTORY\nThe purpose of a data classification is to summarize the data types contained within the data set inventory of this system. IT systems should be classified as “sensitive” if a type of data handled by the IT system has two or more classifications with a sensitivity of moderate on the criteria of confidentiality, integrity, and availability.  Documentation should be developed and maintained by the agency in cases where this determination is identified as “non-sensitive.”  The data classification types are:  PCI, PII, PHI, HIPAA, PMI, FTI, FERPA, Control Systems/SCADA, Intellectual Prop","cbCaiazPqJfcqaT1","https://ap.wps.com/l/cbCaiazPqJfcqaT1","docx",241659,128,"English","# EXECUTIVE SUMMARY\n# SYSTEM INVENTORY & DEFINITION\n## DATA SET CLASSIFICATION INVENTORY\n## BUSINESS PROCESSES\n## SYSTEM BOUNDARY DIAGRAM\n## INFORMATION FLOW DIAGRAM\n## CSRM RESOURCES\n# ITRM-SEC530 CONTROLS\n## AC - ACCESS CONTROL\n## AU - AUDIT AND ACCOUNTABILITY\n## CA - SECURITY ASSESSMENT AND AUTHORIZATION\n## CM - CONFIGURATION MANAGEMENT\n## IA - IDENTIFICATION AND AUTHENTICATION\n## IR - INCIDENT RESPONSE\n## MA - MAINTENANCE\n## PE - PHYSICAL AND ENVIRONMENTAL PROTECTION\n## PL - PLANNNING\n## RA - RISK ASSESSMENT\n## SA - SYSTEM AND SERVICES ACQUISITION\n## SC - SYSTEM AND COMMUNICATION PROTECTION\n## SI - SYSTEM AND INFORMATION INTEGRITY\n## POAM/Remediation Plan Template","[{\"question\":\"What is the purpose of the data set classification inventory in this security plan?\",\"answer\":\"It summarizes data types in the system’s data set inventory and determines whether the system is sensitive based on confidentiality, integrity, and availability criteria. Documentation is required when the determination is “non-sensitive.”\"},{\"question\":\"How should system and application inventory information be submitted?\",\"answer\":\"Complete the application inventory template so the information can be populated into the CSRM GRC application. Submit the completed inventory spreadsheet to CommonwealthSecurity@VITA.Virginia.Gov.\"},{\"question\":\"How is the SEC530 security control catalog expected to be used?\",\"answer\":\"For each SEC530 control, indicate the implementation status and describe the detailed implementation strategy—how the control is met for the specific IT system.\"}]","SECURITY PLAN HISTORY - Sensitive System Specific - SECURITY PLAN HISTORY | DOCX",1788310375,45]