What is a cybersecurity plan, and what does it contain?

A controlled project document that captures every security activity, the justification for any tailoring, and who does what. It is linked to the project plan and kept current. ISO/SAE 21434 requires one; elsewhere it is recommended.

The plan turns "we will build it securely" into commitments that can be checked. A typical structure:

0. Document information: ID, owner and approvers, effective date, review cycle, version history. It is under document control.
1. Overview and scope: product information, applicable laws and standards, classification and certification requirements.
2. Secure development process: process overview, steps with quality and security gates and their deliverables, integration with the normal product development process.
3. Cybersecurity activities: deliverables for this project, tailoring and reuse of deliverables, time and resource planning, post-launch activities.
4. Responsibilities: project team, stakeholders, suppliers, customers.
5. Definitions and references.

The tailoring section matters most. Skipping an activity is legitimate when a component is reused or low-risk, but the reason has to be written down. Unjustified tailoring is one of the phase's named pitfalls.