# PL-10 Baseline Selection

NIST SP 800-53 control. Family: PL Planning. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Select a control baseline for the system.
Guidance: Control baselines are predefined sets of controls specifically assembled to address the protection needs of a group, organization, or community of interest. Controls are chosen for baselines to either satisfy mandates imposed by laws, executive orders, directives, regulations, policies, standards, and guidelines or address threats common to all users of the baseline under the assumptions specific to the baseline. Baselines represent a starting point for the protection of individuals’ privacy, information, and information systems with subsequent tailoring actions to manage risk in accordance with mission, business, or other constraints (see PL-11). Federal control baselines are provided in [SP 800-53B]. The selection of a control baseline is determined by the needs of stakeholders. Stakeholder needs consider mission and business requirements as well as mandates imposed by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. For example, the control baselines in [SP 800-53B] are based on the requirements from [FISMA] and [PRIVACT]. The requirements, along with the NIST standards and guidelines implementing the legislation, direct organizations to select one of the control baselines after the reviewing the information types and the information that is processed, stored, and transmitted on the system; analyzing the potential adverse impact of the loss or compromise of the information or system on the organization’s operations and assets, individuals, other organizations, or the Nation; and considering the results from system and organizational risk assessments. [CNSSI 1253] provides guidance on control baselines for national security systems.

## Patterns that use it (1)
- Important (1): SP-018 Information Security Management System

## Clauses by framework (35 frameworks)
- iso_27001_2022: 4.3, 6.1, 6.1.3, 8.1. OSA's own, not in NIST's crosswalk: 4.3, 6.1, 6.1.3, 8.1
- cobit_2019: APO13, EDM01
- pci_dss_v4: 2.1, 2.2
- finos_ccc: CCC-C14
- iec_62443: 3-3 SR 7.6
- nis2: Art. 21(2)(a)
- apra_cps_234: Para 15
- pra_op_resilience: PS6/21-2.1
- bsi_grundschutz: ISMS.1
- anssi: Hygiene.36
- osfi_b13: B-13.1.2
- finma_circular: IV.A(23), IV.A(25)
- gdpr: Art.24(1)
- dora: Art.6(1), Art.24(2)
- rbi_csf: Annex1.5
- fisc: FISC.T1
- lgpd_bcb: BCB.Art.3-Supp
- hkma_tme1: TME1.2.3
- cbb_tm: TM-4
- cbuae: CR-2
- qatar_nia: GV, RM
- uae_ia: T1, T2
- bog_cisd: CISD-III
- bom_ctrm: 1.4, 3.1
- cbe_csf: CRM-1, GOV-1
- cbn_csf: Part1.3, Part2.1
- sa_js2: JS2-5
- eba_ict: 3.1, 3.3.1, 3.3.4
- hipaa_sr: §164.308(a)(1)(ii)(B)
- iosco_cyber: GOV-3, PFMI-3
- hitrust_csf: 00.a
- naic_ds: 9
- nhs_dspt: NDG-9.1
- pra_ss1_23: P5.1
- solvency_ii: Art.44(1), EIOPA-ICT-4.2
OSA's mapping for iso_27001_2022 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PL-10
- Clauses only: /api/v1/controls/PL-10?fields=mappings
- Page for people: /controls/pl-10/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.