What best describes PL-6 Security Related Activity Planning?

• A. The org plan and coordinates security-related activities affecting the information system before conducting activities in order to reduce the impact on org operations
• B. A post-incident review procedure for security events
• C. A process for granting user access to the system
• D. A data retention schedule for information assets

Answer: (A)

Security Related Activity Planning is about planning and coordinating security actions that affect the information system before you carry them out, so you can reduce disruption to operations. It involves aligning with change control, risk assessment, scheduling, and stakeholder communication to ensure activities like maintenance, configuration changes, scans, or tests are performed in a controlled way. This pre-activity planning and coordination is exactly what the description emphasizes, helping minimize impact on the organization’s operations. Other options describe post-incident review, access provisioning, or data retention—areas that don’t involve planning security activities ahead of time.