NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| PM-01 | Information Security Program Plan | a. Develop and disseminate an organization-wide information security program plan that: 1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls i | |
| PM-02 | Information Security Program Leadership Role | Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program. | |
| PM-03 | Information Security and Privacy Resources | a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; b. Prepare documentation required for addressing informa | |
| PM-04 | Plan of Action and Milestones Process | a. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems: 1. Are developed and maintained; 2. Document the re | |
| PM-05 | System Inventory | Develop and update [Assignment: frequency] an inventory of organizational systems. | |
| PM-05(01) in PM-5 |
Inventory of Personally Identifiable Information | Establish, maintain, and update [Assignment: frequency] an inventory of all systems, applications, and projects that process personally identifiable information. | |
| PM-06 | Measures of Performance | Develop, monitor, and report on the results of information security and privacy measures of performance. | |
| PM-07 | Enterprise Architecture | Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation. | |
| PM-07(01) in PM-7 |
Offloading | Offload [Assignment: non-essential functions or services] to other systems, system components, or an external provider. | |
| PM-08 | Critical Infrastructure Plan | Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan. | |
| PM-09 | Risk Management Strategy | a. Develops a comprehensive strategy to manage: 1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and 2. Privacy risk | |
| PM-10 | Authorization Process | a. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes; b. Designate individuals to fulfill specific roles and responsibilities within the organ | |
| PM-11 | Mission and Business Process Definition | a. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; an | |
| PM-12 | Insider Threat Program | Implement an insider threat program that includes a cross-discipline insider threat incident handling team. | |
| PM-13 | Security and Privacy Workforce | Establish a security and privacy workforce development and improvement program. | |
| PM-14 | Testing, Training, and Monitoring | a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: 1. Are developed and maintained; and 2. Continue to be ex | |
| PM-15 | Security and Privacy Groups and Associations | Establish and institutionalize contact with selected groups and associations within the security and privacy communities: a. To facilitate ongoing security and privacy education and training for organizational personnel; b. To maintain curr | |
| PM-16 | Threat Awareness Program | Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence. | |
| PM-16(01) in PM-16 |
Automated Means for Sharing Threat Intelligence | Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information. | |
| PM-17 | Protecting Controlled Unclassified Information on External Systems | a. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, execu | |
| PM-18 | Privacy Program Plan | a. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and: 1. Includes a description of the structure of the privacy program and the resources dedicated to the privac | |
| PM-19 | Privacy Program Leadership Role | Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy pr | |
| PM-20 | Dissemination of Privacy Program Information | Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that: a. Ensures that the public has access to information about | |
| PM-20(01) in PM-20 |
Privacy Policies on Websites, Applications, and Digital Services | Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that: (a) Are written in plain language and organized in a way that is easy to understand and navigate; (b) Provide informat | |
| PM-21 | Accounting of Disclosures | a. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: 1. Date, nature, and purpose of each disclosure; and 2. Name and address, or other contact information of the individual or org | |
| PM-22 | Personally Identifiable Information Quality Management | Develop and document organization-wide policies and procedures for: a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b. Correcting or deleting i | |
| PM-23 | Data Governance Body | Establish a Data Governance Body consisting of [Assignment: roles] with [Assignment: responsibilities]. | |
| PM-24 | Data Integrity Board | Establish a Data Integrity Board to: a. Review proposals to conduct or participate in a matching program; and b. Conduct an annual review of all matching programs in which the agency has participated. | |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | a. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research; b. Limit or minimize the amount of personally identifiable information use | |
| PM-26 | Complaint Management | Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: a. Mechanisms that are easy to use and readily accessible by the | |
| PM-27 | Privacy Reporting | a. Develop [Assignment: privacy reports] and disseminate to: 1. [Assignment: oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and 2. [Assignment: officials] and other personnel with re | |
| PM-28 | Risk Framing | a. Identify and document: 1. Assumptions affecting risk assessments, risk responses, and risk monitoring; 2. Constraints affecting risk assessments, risk responses, and risk monitoring; 3. Priorities and trade-offs considered by the organiz | |
| PM-29 | Risk Management Program Leadership Roles | a. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and b. Establish a Risk Executive (fun | |
| PM-30 | Supply Chain Risk Management Strategy | a. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; b. Implement the supply chain risk manageme | |
| PM-30(01) in PM-30 |
Suppliers of Critical or Mission-essential Items | Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services. | |
| PM-31 | Continuous Monitoring Strategy | Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: [Assignment: metrics]; b. Establishing [Assignme | |
| PM-32 | Purposing | Analyze [Assignment: systems or system components] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose. |
37 of 1196.