Policy and Procedure Management Policy

Approval #

Revision History #

Review cycle: Every year, on the cycle this policy sets.

Mandate. Every National Institute of Standards and Technology (NIST) SP 800-53 family policy control carries a part (b): AC-1(b) through SR-1(b), present in every SP 800-53B baseline. Part (b) requires the organization to review and update its security policies and procedures on a defined frequency, and after defined events. Federal Information Security Modernization Act (FISMA) 44 U.S.C. § 3554(b)(2)(D) and Office of Management and Budget (OMB) Circular A-130 Appendix I require agencies to put those policies and procedures into practice. NIST SP 800-53 PM-1 requires a security program plan that the rest of the document set supports. In this policy, the CISO sets one review cycle, one approval authority, and one library for every document the security office issues, so that no individual document has to restate them.

1. Purpose and Scope #

This policy covers how the Office of the Chief Information Security Officer writes, approves, publishes, reviews, and retires its documents. It applies to every policy, standard, procedure, standard operating procedure, plan, template, and reference document that office issues.

Every one of those documents follows the review cycle and the approval authority set out in this policy. A document states its own review cycle only where a law, a federal directive, or the document’s own authority sets a different one. The Agency Logging Plan is one example. OMB M-26-14 requires an update within 30 days of a Cybersecurity and Infrastructure Security Agency (CISA) notice that the logging reference architecture has changed, so that plan carries its own cycle.

2. Document Types and Identifiers #

Every document carries its identifier and version on the cover page. The signature page follows the cover, and the revision history follows the signature page. The revision history records the date, the version, the change, and the reviewer of every revision. A sentence under it states how often the document is reviewed.

3. Review Cycle #

The CISO must review each document at least every year. The CISO must also review a document sooner when any of the following happens:

• a law, executive order, directive, regulation, or standard that applies to the document changes significantly;
• OMB or CISA issues new or significantly revised direction;
• an assessment, audit, or incident finds a deficiency in the document; or
• the organization’s mission or enterprise architecture changes materially.

A review that changes nothing still produces a record. The reviewer records the review date and the decision to leave the document as it stands. That record is how the organization shows an assessor that the obligation in part (b) of each family policy control was met.

4. Approval #

The CISO approves every document this policy covers, and signs its signature page, except the privacy documents, the Chief Information Officer (CIO) documents, and the Controlled Unclassified Information (CUI) documents.

The Senior Agency Official for Privacy (SAOP) approves the privacy documents and signs their signature pages. OMB M-16-24 and OMB Circular A-130 give the SAOP the central policy-making role for privacy. OMB M-17-12 makes the SAOP the lead for breach response planning. The privacy documents are:

• the Personally Identifiable Information Processing and Transparency Policy and its procedure;
• the Breach Response Plan;
• the Privacy Program Plan;
• the Privacy Continuous Monitoring Strategy.

The CISO concurs on each privacy document where it relies on security controls, and signs it as concurring.

The Chief Information Officer (CIO) approves the documents the CIO owns and signs their signature pages. The Clinger-Cohen Act and the Federal Information Technology Acquisition Reform Act give the CIO a significant role in managing and overseeing information technology. Each CIO document names the CIO on its signature page. The CIO documents are:

• the IT Governance and Investment Management Policy and its procedure;
• the IT Asset Management Policy and its procedure;
• the Internet Protocol Version 6 (IPv6) Policy and the IPv6 Transition Procedure;
• the Mobile Device Policy and the Mobile Device Procedure;
• the Enterprise Architecture Policy and its procedure.

The CISO concurs on each CIO document and signs it as concurring.

The CUI Senior Agency Official (CUI SAO) approves and signs the CUI Policy and the CUI waiver template. Under 32 CFR 2002.8(c), the CUI SAO directs the Controlled Unclassified Information (CUI) program and makes sure the Organization has CUI policies. Only the CUI SAO grants marking waivers (32 CFR 2002.38). The CUI Program Manager approves and signs the CUI procedures. The CUI documents are:

• the Controlled Unclassified Information (CUI) Policy;
• the CUI Marking Procedure;
• the CUI Safeguarding and Dissemination Procedure;
• the CUI Decontrol and Destruction Procedure;
• the CUI Challenges and Misuse Reporting Procedure;
• the CUI Waivers and Self-Inspection Procedure;
• the CUI Waiver Memorandum Template.

The CISO concurs on each CUI document and signs it as concurring.

Where a regulation requires another official to sign a document, that signature goes in the body of the document, and the CISO still approves the document itself. The designation memoranda for Controlled Unclassified Information work this way: the agency head and the CUI Senior Agency Official sign the memoranda they are required to sign.

5. Publication and Distribution #

The CISO’s office publishes each approved document in the policy library in The document management system. The library holds the version history, the review and approval record, and the distribution list for each release. On publication, the office sends a distribution notice to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and the other stakeholders on the document’s distribution list.

Personnel must use the copy in the policy library. A copy saved elsewhere is not authoritative.

6. Revisions #

The author raises the whole number of the version when a revision changes an obligation, a role, a cadence, or a threshold. The author raises the decimal when a revision only corrects wording, formatting, or a broken reference. Each revision adds a row to the revision history that names the date, the version, what changed, and who reviewed it.

7. Retirement #

The CISO retires a document when the requirement behind it ends, or when another document replaces it. The CISO’s office marks the retired document as superseded in the policy library, names the document that replaces it, and keeps it for the period the records schedule sets. A document whose authority sunsets is reviewed before that date. The Large Language Model Procurement Requirements are one example, because OMB M-26-04 sunsets on December 11, 2027.

8. Records #

The records this policy produces are the approved documents in the policy library, their version histories, the signature pages, the review records with their dates and decisions, the distribution notices, and the superseded register.

9. References #

These are the sources this document cites, with a link to each official text.

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• Clinger-Cohen Act of 1996 (Information Technology Management Reform Act) (Pub. L. 104-106, Division E; 40 U.S.C. § 11101 et seq.), February 10, 1996.
• Federal Information Technology Acquisition Reform Act (Pub. L. 113-291), December 19, 2014.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-26-04: Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles, December 11, 2025.
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.