Which document is developed as a result of assessing foreign collection threat to an acquisition program?

Which document is developed as a result of assessing foreign collection threat to an acquisition program?

• A. System Security Plan
• B. Security Classification Guide
• C. Program Protection Plan (PPP)
• D. Information Assurance Strategy

Answer: (C)

When you assess the risk of foreign collection to an acquisition program, you’moving from threat assessment to a plan of how to defend the program across its life cycle. The document that captures all those protective actions, requirements, controls, and milestones is the Program Protection Plan. It translates the threat assessment into concrete protections for critical program information, design features, supply chain security, manufacturing and test controls, and operational procedures. It ensures that safeguards are integrated into development, production, and fielding, and it guides how to reduce risk from foreign intelligence threats. The System Security Plan focuses on implementing system-level security controls within the system, not specifically the program-wide protections stemming from a foreign collection threat assessment. The Security Classification Guide sets how information is classified and handled, not the program’s protection measures. The Information Assurance Strategy addresses protecting information assets and cyber-related risks more broadly, rather than detailing protection measures for CPI in an acquisition program.

When you assess the risk of foreign collection to an acquisition program, you’moving from threat assessment to a plan of how to defend the program across its life cycle. The document that captures all those protective actions, requirements, controls, and milestones is the Program Protection Plan. It translates the threat assessment into concrete protections for critical program information, design features, supply chain security, manufacturing and test controls, and operational procedures. It ensures that safeguards are integrated into development, production, and fielding, and it guides how to reduce risk from foreign intelligence threats.

The System Security Plan focuses on implementing system-level security controls within the system, not specifically the program-wide protections stemming from a foreign collection threat assessment. The Security Classification Guide sets how information is classified and handled, not the program’s protection measures. The Information Assurance Strategy addresses protecting information assets and cyber-related risks more broadly, rather than detailing protection measures for CPI in an acquisition program.