The Cybersecurity Strategy annex to the Program Protection Plan is appended to which plan?

• A. Acquisition Strategy Plan
• B. Program Protection Plan
• C. System Security Plan
• D. Operations Plan

Answer: (B)

The main idea being tested is where the program-level approach to cybersecurity belongs within the program’s protective documentation. The Cybersecurity Strategy annex lays out how the program will handle cybersecurity across the life cycle, including governance, risk management, controls, and oversight. It is placed with the Program Protection Plan because this plan is the umbrella document that guides how the program protects critical components, information, and missions across all phases and across suppliers. By appending the Cybersecurity Strategy to the Program Protection Plan, the strategy becomes an integral part of the overall protection approach, ensuring cybersecurity is considered at the program level, not just at a single system or in procurement or operations documents.

The other plans focus on different things: the Acquisition Strategy Plan centers on how to procure and integrate capabilities, not on cybersecurity strategy; the System Security Plan describes security controls for a specific system rather than the program as a whole; the Operations Plan covers how the program will be run in its operations, not the strategic direction for cybersecurity.