Program Management Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for program management in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers governance of the security program itself. The Organization must resource the program through the capital planning process and place it under a designated CISO with authority. It must measure the program against the Inspector General (IG) FISMA maturity model and integrate it with enterprise risk management under OMB A-123. Under this policy, the CISO maintains the program plan, the risk management strategy, the workforce development pipeline, and the insider threat and supply chain programs. It also sets executive reporting that keeps leadership accountable for cybersecurity outcomes.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• GV.OC — Organizational Context (Govern function)
• GV.RM — Risk Management Strategy (Govern function)
• GV.RR — Roles, Responsibilities, and Authorities (Govern function)
• GV.PO — Policy (Govern function)
• GV.OV — Oversight (Govern function)
• ID.AM — Asset Management (Identify function)
• ID.RA — Risk Assessment (Identify function)
• ID.IM — Improvements (Identify function)
• PR.AT — Awareness and Training (Protect function)

These categories fall under the Govern, Identify, Protect function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every program management control in the high baseline of FIPS 200 and NIST SP 800-53B:

• PM-01 — Information Security Program Plan
• PM-02 — Information Security Program Leadership Role
• PM-03 — Information Security and Privacy Resources
• PM-04 — Plan of Action and Milestones Process
• PM-05 — System Inventory
• PM-05(1) — Inventory of Personally Identifiable Information
• PM-06 — Measures of Performance
• PM-07 — Enterprise Architecture
• PM-07(1) — Offloading
• PM-08 — Critical Infrastructure Plan
• PM-09 — Risk Management Strategy
• PM-10 — Authorization Process
• PM-11 — Mission and Business Process Definition
• PM-12 — Insider Threat Program
• PM-13 — Security and Privacy Workforce
• PM-14 — Testing, Training, and Monitoring
• PM-15 — Security and Privacy Groups and Associations
• PM-16 — Threat Awareness Program
• PM-16(1) — Automated Means for Sharing Threat Intelligence
• PM-17 — Protecting Controlled Unclassified Information on External Systems
• PM-18 — Privacy Program Plan
• PM-19 — Privacy Program Leadership Role
• PM-20 — Dissemination of Privacy Program Information
• PM-20(1) — Privacy Policies on Websites, Applications, and Digital Services
• PM-21 — Accounting of Disclosures
• PM-22 — Personally Identifiable Information Quality Management
• PM-23 — Data Governance Body
• PM-24 — Data Integrity Board
• PM-25 — Minimization of Personally Identifiable Information Used in Testing, Training, and Research
• PM-26 — Complaint Management
• PM-27 — Privacy Reporting
• PM-28 — Risk Framing
• PM-29 — Risk Management Program Leadership Roles
• PM-30 — Supply Chain Risk Management Strategy
• PM-30(1) — Suppliers of Critical or Mission-essential Items
• PM-31 — Continuous Monitoring Strategy
• PM-32 — Purposing

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Executive Order 14306: Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending EO 13694 and EO 14144, June 6, 2025.
• OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, April 3, 2025.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PM control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-25-04: FY 2025 FISMA Guidance

• The organization must prioritize cybersecurity efforts aligned with EO 14028, the National Cybersecurity Strategy, and OMB cyber policy guidance. Resources must be focused on maturing zero trust architectures, implementing continuous monitoring, and modernizing legacy systems. Deadline: FY 2025. (OMB M-25-04, §1)
• The organization must ensure security and privacy coordination, integrating security and privacy planning, monitoring, and reporting. This coordination is essential for managing risk and complying with FISMA requirements. (OMB M-25-04, §4)

NIST SP 800-39: Managing Information Security Risk

• The organization must establish a risk management strategy that defines risk tolerance, priorities, and the approach for managing risk across the organization. This strategy must guide resource allocation and security investment decisions. (NIST SP 800-39, §2.1)

Executive Order 14028: Improving the Nation’s Cybersecurity

• The organization must modernize cybersecurity by adopting zero trust architecture, improving software supply chain security and detection and response, and removing barriers to sharing threat information. (EO 14028, §1)

OMB Circular A-130: Managing Information as a Strategic Resource

• The organization must manage information security as a continuous, risk-based program rather than a compliance exercise. Security and privacy must be integrated into the information lifecycle from planning through disposal. (OMB Circular A-130, §5)
• The organization must have the CIO review and approve every acquisition strategy, acquisition plan, and interagency agreement that includes IT before it is approved. (OMB Circular A-130, §5(d)(2))
• The organization must affirm in the initial budget submission to OMB that the CIO reviewed and approves the IT investments portion of the budget request, and that the SAOP reviewed it for privacy requirements and costs. (OMB Circular A-130, §5(a)(3)(e))
• The organization must have the CIO lead TechStat reviews or other performance reviews of IT investments; the CIO may recommend that the agency head modify, pause, or end an investment. (OMB Circular A-130, §5(b)(5))

FISMA Act of 2014

• The organization must develop, document, and implement an agency-wide information security program that includes risk assessments, policies, procedures, sub-plan integration, security awareness training, and continuous monitoring. (FISMA 2014, 44 U.S.C. § 3554)
• The organization must report each year on the adequacy and effectiveness of information security policies, procedures, and practices to OMB, DHS, Congress, and the Comptroller General. Deadline: Annually. (44 U.S.C. § 3554(c))

OMB M-19-03: Strengthening Cybersecurity through the High Value Asset Program

• The organization must designate accountable senior officials for HVA governance and integrate HVA identification, protection, and assessment activities into the agency-wide risk management and enterprise architecture programs. (OMB M-19-03, §B)

Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks

• The organization must the agency head identifies a PQC migration lead, an employee or detailee who reports to the CIO, and sends the lead’s name and contact details to the Director of OMB and the National Cyber Director within 30 days of the order. Deadline: 2026-07-22. (EO 14412, §4(a) and §2(h))

OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6)

• The organization must designate an agency-wide IPv6 integrated project team to lead the transition to IPv6. (OMB M-21-07)

OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy

• The organization must designate a Senior Agency Official for Privacy with the authority, independence, and resources to lead the agency-wide privacy program. (OMB M-16-24; EO 13719)

40 U.S.C. § 11312: Capital planning and investment control process of each executive agency

• The organization must run one capital planning and investment control process that selects, manages, and evaluates IT investments, including information security needs, and ties them to budget, financial, and program decisions. (40 U.S.C. § 11312)

OMB Circular A-11: Preparation, Submission, and Execution of the Budget

• The organization must conduct IT capital planning internally under OMB Circular A-130 and the Capital Programming Guide even when OMB does not require the agency to report its IT portfolio data. (OMB Circular A-11, §51.3(b))

OMB Circular A-123: Management’s Responsibility for Internal Control

• The organization must agency leadership defines the Organization’s objectives and develops its risk appetite and risk tolerance levels, and officials use them to decide how to respond to each risk. (OMB Circular A-123, §II.B)

OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust

• The organization should maintain Super Intelligence (SI) governance that names accountable officials (including a Chief AI Officer or equivalent), sets workforce expectations for appropriate SI use — especially where SI supports consequential decisions — and publishes an annual SI use-case inventory. Deadline: Annual SI use-case inventory. (OMB M-25-21, Appendix)

OMB M-26-10: Reinforcing Transparency, Accountability, and Oversight of Federal Technology

• The organization should collect and share vendor utilization and prices-paid data for IT contracts as OMB directs, and keep the CIO involved in agency IT contract decisions consistent with FITARA. (OMB M-26-10, §2)

NIST IR 8286 Rev. 1: Integrating Cybersecurity and Enterprise Risk Management (ERM)

• The organization should record cybersecurity risks in system and organization risk registers, and roll them up into the enterprise risk register for senior leaders. (NIST IR 8286 Rev. 1, §3.8)

OMB M-19-23: Phase 1 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018

• The organization should keep a Data Governance Body that the Chief Data Officer chairs, with senior staff from business units, data functions, and financial management. (OMB M-19-23)

OMB M-25-05: Phase 2 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Open Government Data Access and Management Guidance

• The organization should keep a comprehensive data inventory of all data assets. Add each new data asset within 90 days and review the whole inventory at least once a year. Deadline: Within 90 days of a new data asset; at least yearly. (OMB M-25-05)

EO 14434: Inaugurating the Era of Super Intelligence

• The organization should use the terms Super Intelligence and SI in place of artificial intelligence and AI in the Organization’s policies, procedures, plans, reports, and other non-statutory documents. Keep the titles of earlier sources, statutory terms, and quoted text as published. (EO 14434, §§ 2(a)-(b), 3(a))

3. Policy #

The Organization must implement and maintain its program management controls to meet the following requirements:

PM-01 — Information Security Program Plan #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.OC (Organizational Context), GV.RR (Roles, Responsibilities, and Authorities), GV.PO (Policy)

Requirement:

1. Develop and disseminate an organization-wide information security program plan that:

1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects the coordination among organizational entities responsible for information security; and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;

2. Review and update the organization-wide information security program plan [Assignment: organization-defined frequency — to be defined] and following [Assignment: organization-defined events — to be defined]; and
3. Protect the information security program plan from unauthorized disclosure and modification.

Implementation guidance:

The CISO must develop and maintain an Information Security Program Plan that covers the whole Organization. The plan must summarize the security requirements the Organization must meet under FISMA (44 U.S.C. § 3554). It must list the program management controls and common controls that are in place or planned. It must name the roles and responsibilities for the program and state management’s commitment to it. It must describe how the Chief Information Officer (CIO), the Senior Agency Official for Privacy (SAOP), System Owners, and other offices coordinate on security. The plan must refer to the risk management strategy, which sets the Organization’s risk tolerance and priorities, per NIST SP 800-39. The Senior Accountable Official for Risk Management must approve the plan. The CISO must review and update the plan [PM-01 parameter 1 — to be defined] and after [PM-01 parameter 2 — to be defined]. The CISO must protect the plan from unauthorized disclosure and change by limiting edit rights in the document management system to the CISO’s staff.

PM-02 — Information Security Program Leadership Role #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.OC (Organizational Context), GV.RR (Roles, Responsibilities, and Authorities)

Requirement:

Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.

Implementation guidance:

The CIO must designate a Chief Information Security Officer (CISO) to serve as the senior agency information security officer, as FISMA (44 U.S.C. § 3554) requires. Information security must be the CISO’s primary duty. The CISO must head an office with the staff and funds to develop, run, and maintain the information security program across the Organization. The CIO must give the CISO authority to issue security policies and procedures and to require System Owners to correct weaknesses. The CISO must coordinate security and privacy planning, monitoring, and reporting with the Senior Agency Official for Privacy (SAOP), per OMB M-25-04. The CISO must brief the CIO and the Senior Accountable Official for Risk Management on program risk and resource needs.

PM-03 — Information Security and Privacy Resources #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

Requirement:

1. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
2. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
3. Make available for expenditure, the planned information security and privacy resources.

Implementation guidance:

The CIO must include the resources needed for the information security and privacy programs in every capital planning and investment request. System Owners must state the security and privacy costs of their systems in each investment request. These costs include staff, tools, assessments, and continuous monitoring. The CISO and the Senior Agency Official for Privacy (SAOP) must add program-level costs and confirm that each request covers its security and privacy needs. If a request leaves out these resources, the System Owner must document the exception and the reason, and the CIO must approve it. Per OMB M-25-04, the CIO and the CISO must give priority to zero trust architecture, continuous monitoring, and modernizing legacy systems. The CIO must stay involved in IT contract decisions, per OMB M-26-10. The CIO must make the planned security and privacy funds available to spend once the Organization receives them.

PM-04 — Plan of Action and Milestones Process #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

Requirement:

1. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:

1. Are developed and maintained;
2. Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
3. Are reported in accordance with established reporting requirements.

2. Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Implementation guidance:

The CISO must run a plan of action and milestones (POA&M) process that covers the information security, privacy, and supply chain risk management programs and every system. System Owners must record each system weakness as a POA&M item in the governance, risk, and compliance (GRC) system. Each item must show an owner, the planned fix, the resources needed, milestones, and a completion date. The CISO must keep a program-level POA&M in the GRC system for weaknesses in common controls, the security program, and supply chain risk management. The Senior Agency Official for Privacy (SAOP) must keep the privacy program items. The CISO must review all items against the risk tolerance and priorities in the Risk Management Strategy (PLAN-RMS-001), per NIST SP 800-39. An Authorizing Official may propose to accept a risk that exceeds that tolerance. In that case, the CISO and the CIO must send the proposal to the Senior Accountable Official for Risk Management. The CISO must report POA&M status as FISMA reporting requires.

PM-05 — System Inventory #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), ID.AM (Asset Management)

Requirement:

Develop and update [Assignment: organization-defined frequency — to be defined] an inventory of organizational systems.

Implementation guidance:

The CISO must maintain one inventory of all organizational systems in the GRC system and update it [PM-05 parameter 1 — to be defined]. Each System Owner must register a system in the inventory before any authorization work for that system begins. The System Owner must draw the system boundary around resources that share common management control, a common mission, similar security needs, and the same operating environment. The System Owner must record a subsystem under its parent system rather than as a separate entry.

When a system transfers to another owner or merges with another system, the System Owner must update the inventory entry, and the Authorizing Official must reopen the authorization. The CIO must use the inventory to plan security investments and to report on the agency’s systems as OMB Circular A-130 requires.

PM-05(1) — Inventory of Personally Identifiable Information #

Baselines: Privacy

Requirement:

Establish, maintain, and update [Assignment: organization-defined frequency — to be defined] an inventory of all systems, applications, and projects that process personally identifiable information.

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must maintain an inventory of every system, application, and project that processes personally identifiable information (PII), and update it [PM-05(1) parameter 1 — to be defined]. Each System Owner and project lead must tell the Privacy Officer before a system or project begins to process PII. The SAOP must use the inventory to confirm that each use of PII stays within its stated purpose and is still needed.

PM-06 — Measures of Performance #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), GV.OV (Oversight), ID.IM (Improvements)

Requirement:

Develop, monitor, and report on the results of information security and privacy measures of performance.

Implementation guidance:

The CISO and the Senior Agency Official for Privacy (SAOP) must each set measures of performance for the security program and the privacy program. Each measure must state what it counts, its data source, its target, and its owner. The targets must reflect the risk tolerance in the agency risk management strategy, as NIST SP 800-39 directs.

The CISO and SAOP must track results against targets and report them to the CIO and to the Senior Accountable Official for Risk Management. They must use the results in the annual report that FISMA requires. When a measure misses its target, the measure owner must record the gap and a corrective action as a program-level POA&M item.

PM-07 — Enterprise Architecture #

Baselines: Privacy / High Value Asset (HVA) overlay CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

Requirement:

Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Implementation guidance:

The CIO must maintain an enterprise architecture that includes security and privacy requirements for all organizational systems. The CISO must define the security architecture and the Senior Agency Official for Privacy (SAOP) must define the privacy architecture at the enterprise level. Each system architecture must stay consistent with them.

The CIO, CISO, and SAOP must consider the risk to operations, assets, individuals, other organizations, and the Nation when they approve architecture changes. The architecture must support zero trust goals and the replacement of legacy systems, as OMB M-25-04 directs. The CIO must place high value assets in the architecture and in the risk management program, as OMB M-19-03 requires. The CIO sets the rules for the current and target architectures, the transition plan, architecture reviews, and technology standards in the Enterprise Architecture Policy.

PM-07(1) — Offloading #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Requirement:

Offload [Assignment: organization-defined non-essential functions or services — to be defined] to other systems, system components, or an external provider.

Implementation guidance:

System Owners must move [PM-07(1) parameter 1 — to be defined] off systems and components that support mission-essential functions. They must place those functions on separate systems, separate components, or an external provider. The CIO must approve each move to an external provider, and the provider must hold an authorization the Authorizing Official accepts.

PM-08 — Critical Infrastructure Plan #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

Requirement:

Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.

Implementation guidance:

The CIO must make sure the agency critical infrastructure and key resources protection plan addresses security and privacy. The CISO must supply the security content and the Senior Agency Official for Privacy (SAOP) must supply the privacy content for the first version of the plan and for each update. The plan must name the systems and high value assets that support critical infrastructure and state how the agency protects them. It must set protection priorities from the importance of those assets, as OMB M-19-03 directs for high value assets.

The CIO must start an update when the high value asset list changes, when a supporting system changes its boundary, or when federal direction changes the requirement.

PM-09 — Risk Management Strategy #

Baselines: Privacy / HVA overlay CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), GV.OV (Oversight), ID.IM (Improvements)

Requirement:

1. Develops a comprehensive strategy to manage:

1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;

2. Implement the risk management strategy consistently across the organization; and
3. Review and update the risk management strategy [Assignment: organization-defined frequency — to be defined] or as required, to address organizational changes.

Implementation guidance:

The Senior Accountable Official for Risk Management must lead a risk executive function and recommend one strategy for managing security risk and privacy risk across the agency. The agency head must approve it. The Risk Management Strategy (PLAN-RMS-001) is that strategy, with its Risk Appetite and Tolerance Statement. As NIST SP 800-39 directs, the strategy must state risk assumptions, constraints, priorities, and risk tolerance. It must also state how the agency assesses, responds to, and monitors risk. The CISO must draft the security content and the Senior Agency Official for Privacy (SAOP) must draft the privacy content.

All officials must apply the strategy in authorization, investment, and acquisition decisions. An Authorizing Official may accept only the risk levels the Risk Management Strategy allows. When an Authorizing Official proposes to accept a risk that exceeds the stated tolerance, the decision must go through the CISO and CIO to the risk executive function. The CISO must review and update the strategy [PM-09 parameter 1 — to be defined] and after a major organizational change.

PM-10 — Authorization Process #

Baselines: Privacy / HVA overlay CSF 2.0: GV.OC (Organizational Context), GV.OV (Oversight)

Requirement:

1. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
2. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
3. Integrate the authorization processes into an organization-wide risk management program.

Implementation guidance:

The CIO must run one authorization process for all systems and common controls, built on the Risk Management Framework. The agency head or a delegate must name an Authorizing Official for each system and each set of common controls. The agency head or the delegate must also name the System Owner, the Information System Security Officer (ISSO), and any Common Control Provider for each system. The Senior Agency Official for Privacy (SAOP) must review privacy risk in each authorization for a system that processes personally identifiable information.

Authorizing Officials must base each decision on current assessment results and the risk tolerance in the agency risk management strategy. The CISO must connect authorizations to continuous monitoring so each decision reflects the current security and privacy state, as FISMA requires.

PM-11 — Mission and Business Process Definition #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context)

Requirement:

1. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
2. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
3. Review and revise the mission and business processes [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

Each Mission/Business Owner must define the mission and business processes in their area and state the security and privacy risk each one creates. The definition must name the information each process uses and the personally identifiable information (PII) it handles. The Mission/Business Owner must work with the CISO and the Senior Agency Official for Privacy (SAOP) to set protection needs and PII processing needs for each process.

System Owners must use these needs when they categorize systems and select controls. The CISO must use them to set the Target Profile in the Cybersecurity Framework Organizational Profile Template (TMPL-CSF-001). Each Mission/Business Owner must review and revise their process definitions [PM-11 parameter 1 — to be defined] and whenever a process changes.

PM-12 — Insider Threat Program #

Baselines: HVA overlay CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), ID.RA (Risk Assessment)

Requirement:

Implement an insider threat program that includes a cross-discipline insider threat incident handling team.

Implementation guidance:

The agency head must designate a senior official to lead an insider threat program for the agency. The senior official must form a team with members from the CISO’s staff, the Security Operations Center, Human Resources, General Counsel, and the Senior Agency Official for Privacy (SAOP). The team must handle insider threat referrals, combine technical and personnel information, and recommend actions.

The senior official must keep a written program plan and give all personnel insider threat awareness training. General Counsel and the SAOP must approve any monitoring that uses personnel records, so the team stays within the law and protects privacy. Team members must share case information only with those who need it for the case.

PM-13 — Security and Privacy Workforce #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), PR.AT (Awareness and Training)

Requirement:

Establish a security and privacy workforce development and improvement program.

Implementation guidance:

The CISO and the Senior Agency Official for Privacy (SAOP) must run a workforce program for staff who hold security and privacy roles. The program must define the knowledge, skills, and abilities each role needs. Human Resources must use those definitions in position descriptions, job postings, and hiring. Supervisors must assign role-based security training and role-based privacy training to each person in a security or privacy role. They must also support career paths that prepare staff for roles with more responsibility.

The CISO and SAOP must report workforce gaps to the CIO, so the CIO can plan resources as FISMA requires.

PM-14 — Testing, Training, and Monitoring #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.OV (Oversight)

Requirement:

1. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:

1. Are developed and maintained; and
2. Continue to be executed; and

2. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Implementation guidance:

The Chief Information Security Officer (CISO) must maintain an organization-wide plan for security testing, training, and monitoring. The Senior Agency Official for Privacy (SAOP) must maintain the matching plan for privacy, including role-based privacy training and breach response exercises. Each plan must name every activity, its owner, and its schedule. System Owners and Common Control Providers must carry out the activities the plans assign to them and report the results to the plan owner.

The CISO and the SAOP must compare both plans with the risk management strategy and the current priorities for risk response, as NIST SP 800-39 requires. They must make this comparison whenever the strategy changes and as part of the annual FISMA reporting cycle. If a plan no longer matches the strategy, the plan owner must revise it before the next round of activities starts. Per OMB M-25-04, the CISO and the SAOP must coordinate the two plans so that security and privacy activities share schedules and results.

PM-15 — Security and Privacy Groups and Associations #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Requirement:

Establish and institutionalize contact with selected groups and associations within the security and privacy communities: a. To facilitate ongoing security and privacy education and training for organizational personnel; b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and c. To share current security and privacy information, including threats, vulnerabilities, and incidents.

Implementation guidance:

The Chief Information Security Officer (CISO) must choose the security groups and professional associations the Organization joins. The Senior Agency Official for Privacy (SAOP) must choose the privacy groups. Each choice must rest on the Organization’s mission and the threats it faces. The CISO and the SAOP must keep a list of each membership, its purpose, and the staff member who serves as point of contact.

Points of contact must use these memberships for staff training, for learning current security and privacy methods, and for exchanging threat, vulnerability, and incident information. Before anyone shares Organization information with a group, the CISO must approve the release. The SAOP must also approve any item that concerns privacy. Staff must never share personally identifiable information (PII) through a group. Per Executive Order (EO) 14028, the CISO must remove internal barriers that keep staff from sharing threat information with federal partners.

PM-16 — Threat Awareness Program #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Requirement:

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

Implementation guidance:

The Chief Information Security Officer (CISO) must run a threat awareness program for the whole Organization. The Security Operations Center (SOC) must receive threat intelligence from federal and industry sources the CISO approves. The SOC must analyze each report and send relevant warnings to the System Owners and Information System Security Officers (ISSOs) whose systems are exposed.

The SOC must also share what the Organization learns with federal partners and sharing groups. Shared items include attacker methods the SOC observes and defenses that worked. The CISO must approve each release, and General Counsel must review any release that contains legally restricted information. Per EO 14028, the CISO must remove contract and policy barriers that keep threat information from reaching the people who need it. Contracting Officers must include threat-sharing terms in contracts for IT services. The CISO must use threat trends to update the organization-wide risk assessment.

PM-16(1) — Automated Means for Sharing Threat Intelligence #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Requirement:

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

Implementation guidance:

The Chief Information Security Officer (CISO) must use automated, machine-readable exchange for threat intelligence wherever a partner supports it. The Security Operations Center (SOC) must load indicators from approved sources into its detection tools without manual retyping. The SOC must share the Organization’s own indicators through the same automated channels after the CISO approves each release. Per EO 14028, the CISO must remove technical barriers that slow this exchange with federal partners. The CISO must review each automated feed when its source changes or stops working.

PM-17 — Protecting Controlled Unclassified Information on External Systems #

Baselines: Privacy

Requirement:

1. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
2. Review and update the policy and procedures [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

The Chief Information Security Officer (CISO) must keep a policy and a procedure for protecting controlled unclassified information (CUI) that contractors and partners handle on systems the Organization does not operate. Before a contractor or partner receives CUI, the Contracting Officer must include CUI safeguarding and incident reporting terms in the contract or agreement. The System Owner must identify each outside system that will hold CUI and record it with the related system in the GRC system.

Information Owners must mark CUI before release and release it only to the parties an agreement covers. Contractors and partners must report any suspected loss or misuse of CUI to the Security Operations Center. The CISO must review this policy [PM-17 parameter 1 — to be defined] and the procedure [PM-17 parameter 2 — to be defined]. The CISO must also update both after a change in federal CUI rules.

PM-18 — Privacy Program Plan #

Baselines: Privacy

Requirement:

1. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:

1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and

2. Update the plan [Assignment: organization-defined frequency — to be defined] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must prepare and approve a privacy program plan that covers the whole Organization. In the plan, the SAOP must describe how the privacy office is organized and the budget and staff assigned to it. The SAOP must list the federal privacy requirements the program meets and the program-level and common privacy controls that meet them.

The plan must name the SAOP, the Privacy Officer, and every other privacy role, with the duties of each. The SAOP must state the program’s goals and describe how privacy staff work with the Chief Information Security Officer (CISO), System Owners, Information Owners, and General Counsel. The SAOP must distribute the approved plan to all staff with privacy duties.

The SAOP must update the plan on this schedule: [PM-18 parameter 1 — to be defined]. The SAOP must also update it after a change in federal privacy law or policy, an organizational change, or a problem found in a privacy control assessment. Per OMB M-25-04, the SAOP and the CISO must align this plan with the security program plan.

PM-19 — Privacy Program Leadership Role #

Baselines: Privacy

Requirement:

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.

Implementation guidance:

The agency head must appoint a Senior Agency Official for Privacy (SAOP) in writing. The appointment must give the SAOP the authority, staff, and budget to run the privacy program across the Organization. The SAOP must report privacy risk directly to the agency head.

The SAOP must approve the privacy program plan and each privacy impact assessment (PIA). The SAOP must agree to the privacy risk in each authorization decision for a system that handles personally identifiable information (PII). The SAOP must lead the privacy part of the annual FISMA report and must serve on the Data Integrity Board and the Data Governance Body. Per OMB M-25-04, the SAOP and the Chief Information Security Officer (CISO) must coordinate security and privacy planning, monitoring, and reporting. When the position is vacant, the agency head must name an acting SAOP.

PM-20 — Dissemination of Privacy Program Information #

Baselines: Privacy

Requirement:

Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that: a. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy; b. Ensures that organizational privacy practices and reports are publicly available; and c. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must keep a privacy page on the Organization’s main public website. On that page, the SAOP must publish the Organization’s privacy policies and privacy reports. The SAOP must also publish privacy impact assessments, system of records notices (SORNs), and computer matching notices and agreements. The page must explain how a person asks to see or correct a record about them.

The SAOP must list a public email address and a phone line that reach the privacy office. Privacy staff must answer questions and complaints that arrive through them. The Privacy Officer must post each new or revised privacy document when it takes effect. The Privacy Officer must remove a document from the page when it is withdrawn.

PM-20(1) — Privacy Policies on Websites, Applications, and Digital Services #

Baselines: Privacy

Requirement:

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that: (a) Are written in plain language and organized in a way that is easy to understand and navigate; (b) Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and (c) Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.

Implementation guidance:

System Owners must post a privacy policy on each public website, mobile app, and other digital service they own. They must link to it from the main entry points and from every page that collects personally identifiable information (PII). The Privacy Officer must write each policy in plain language. A reader must be able to find what the service collects, why, how it uses and shares the data, and what choices the reader has. The Senior Agency Official for Privacy (SAOP) must approve each policy. The System Owner must update the policy when the service’s practices change and show the date of the last change.

PM-21 — Accounting of Disclosures #

Baselines: Privacy

Requirement:

1. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:

1. Date, nature, and purpose of each disclosure; and
2. Name and address, or other contact information of the individual or organization to which the disclosure was made;

2. Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and
3. Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.

Implementation guidance:

Each System Owner of a system of records must log every disclosure of personally identifiable information (PII) from that system. The only exceptions are disclosures that federal law exempts, as General Counsel advises. Each log entry must show the date, what the Organization disclosed and why, and the recipient’s name and address or other contact information.

The System Owner must keep each entry for five years after the disclosure or for the life of the record, whichever is longer. When a person asks, the Privacy Officer must give that person the entries about their own records, unless federal law allows the Organization to withhold them. The Senior Agency Official for Privacy (SAOP) must oversee this process and confirm it works during privacy control assessments.

PM-22 — Personally Identifiable Information Quality Management #

Baselines: Privacy

Requirement:

Develop and document organization-wide policies and procedures for: a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b. Correcting or deleting inaccurate or outdated personally identifiable information; c. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d. Appeals of adverse decisions on correction or deletion requests.

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must keep policies and procedures that keep personally identifiable information (PII) accurate, relevant, current, and complete from collection through disposal. System Owners must check the quality of PII when they collect it and before a system uses it to decide something about a person.

The Privacy Officer must publish how a person asks the Organization to correct or delete PII. Information Owners must correct or delete PII that is wrong or out of date. They must then notify the person and every party that received the old data. If the Organization denies a request, the Privacy Officer must explain the reasons in writing and record the person’s statement of disagreement. The Privacy Officer must also tell the person how to appeal. The SAOP must decide each appeal or name an official who took no part in the first decision.

PM-23 — Data Governance Body #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Requirement:

Establish a Data Governance Body consisting of [Assignment: organization-defined roles — to be defined] with [Assignment: organization-defined responsibilities — to be defined].

Implementation guidance:

The agency head must establish a Data Governance Body. Its members are [PM-23 parameter 1 — to be defined]. The members must carry out these duties: [PM-23 parameter 2 — to be defined]. The Senior Agency Official for Privacy (SAOP) must lead the body and keep its charter current.

The body must confirm that each system holding personally identifiable information (PII) has a privacy impact assessment and, where needed, a published system of records notice (SORN). Each SORN must include the routine uses that let the Organization share data to respond to a breach. The body must set records retention and consent notice requirements for PII. It must review each request to release PII-based data outside the Organization. Per OMB M-25-04, the SAOP must invite the Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) when a decision affects security.

PM-24 — Data Integrity Board #

Baselines: Privacy

Requirement:

Establish a Data Integrity Board to: a. Review proposals to conduct or participate in a matching program; and b. Conduct an annual review of all matching programs in which the agency has participated.

Implementation guidance:

The agency head must establish a Data Integrity Board made up of senior officials. The Senior Agency Official for Privacy (SAOP) and the Inspector General must serve on the board. The board must approve each proposed computer matching program before the Organization signs a matching agreement or releases any records for a match. This rule applies when the Organization runs a match itself and when it supplies records to another agency for a match. Program offices must not start, renew, or change a matching program without board approval.

Each calendar year, the board must review every matching program the Organization took part in during that year. For each program, the board must decide whether it should continue, change, or end. The board must report its findings to the agency head.

PM-25 — Minimization of Personally Identifiable Information Used in Testing, Training, and Research #

Baselines: Privacy

Requirement:

1. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;
2. Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;
3. Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and
4. Review and update policies and procedures [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

Personnel who plan internal testing, training, or research must use data that contains no personally identifiable information (PII) whenever that data meets the purpose. Synthetic, masked, or de-identified data are the first choice. If real PII is needed, the requester must get written approval from the Senior Agency Official for Privacy (SAOP) before anyone copies or uses it.

The SAOP must approve only the data elements and records the purpose needs, and must set an end date for the use. The SAOP must confirm that the use fits the purpose for which the Organization collected the PII, and consults General Counsel when the answer is unclear. System Owners must protect approved PII in a test, training, or research environment the same way they protect it in production.

The Privacy Officer must review and update this policy [PM-25 parameter 1 — to be defined]. The Privacy Officer must review and update the related procedures [PM-25 parameter 3 — to be defined].

PM-26 — Complaint Management #

Baselines: Privacy

Requirement:

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: a. Mechanisms that are easy to use and readily accessible by the public; b. All information necessary for successfully filing complaints; c. Tracking mechanisms to ensure all complaints received are reviewed and addressed within [Assignment: organization-defined time period — to be defined]; d. Acknowledgement of receipt of complaints, concerns, or questions from individuals within [Assignment: organization-defined time period — to be defined]; and e. Response to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period — to be defined].

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must run a process for receiving and answering complaints, concerns, and questions from the public about the Organization’s privacy and security practices. The Privacy Officer must post on the Organization’s public website the ways to file a complaint, the information a complaint should include, and the contact details of the official who receives complaints. The filing methods must be easy for any member of the public to find and use.

The Privacy Officer must log every complaint, concern, or question and review it within [PM-26 parameter 1 — to be defined]. The assigned owner must address each item within [PM-26 parameter 2 — to be defined]. The Privacy Officer must acknowledge receipt within [PM-26 parameter 3 — to be defined] and send the individual a response within [PM-26 parameter 4 — to be defined]. Personnel who handle complaints must protect any personally identifiable information (PII) the complaints contain.

PM-27 — Privacy Reporting #

Baselines: Privacy

Requirement:

1. Develop [Assignment: organization-defined privacy reports — to be defined] and disseminate to:

1. [Assignment: organization-defined oversight bodies — to be defined] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and
2. [Assignment: organization-defined officials — to be defined] and other personnel with responsibility for monitoring privacy program compliance; and

2. Review and update privacy reports [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must prepare [PM-27 parameter 1 — to be defined] and submit them to [PM-27 parameter 2 — to be defined]. The reports must show how the Organization meets the privacy requirements set by statute, regulation, and federal policy. The SAOP must also give the reports to [PM-27 parameter 3 — to be defined] and to other personnel who monitor privacy program compliance. The SAOP must review and update the reports [PM-27 parameter 4 — to be defined].

The privacy results form part of the Organization’s annual information security program report under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3554. The SAOP and the CISO must coordinate their reporting so that security and privacy figures agree, as OMB M-25-04 directs. The SAOP must also submit any other privacy report that a law or OMB requires.

PM-28 — Risk Framing #

Baselines: Privacy

Requirement:

1. Identify and document:

1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
2. Constraints affecting risk assessments, risk responses, and risk monitoring;
3. Priorities and trade-offs considered by the organization for managing risk; and
4. Organizational risk tolerance;

2. Distribute the results of risk framing activities to [Assignment: organization-defined personnel — to be defined]; and
3. Review and update risk framing considerations [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

The Senior Accountable Official for Risk Management must lead the risk executive function in framing risk for the Organization, as NIST SP 800-39 directs. The resulting risk framing statement must record the assumptions, constraints, priorities and trade-offs, and risk tolerance that guide how the Organization assesses, responds to, and monitors risk. The Risk Management Strategy (PLAN-RMS-001) holds the statement. The CISO and the Senior Agency Official for Privacy (SAOP) must contribute the security and privacy views. Mission/Business Owners and System Owners must give input on their missions and systems.

The Senior Accountable Official for Risk Management must send the approved statement to [PM-28 parameter 1 — to be defined]. The risk executive function must review and update the statement [PM-28 parameter 2 — to be defined].

An Authorizing Official who proposes to accept a risk above the stated tolerance must send the proposal through the CISO and the CIO to the risk executive function. The Senior Accountable Official for Risk Management decides on that risk.

PM-29 — Risk Management Program Leadership Roles #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Requirement:

1. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
2. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.

Implementation guidance:

The agency head must appoint a Senior Accountable Official for Risk Management in writing. That official must align information security and privacy risk management with the Organization’s strategic, operational, and budget planning. Security and privacy investment decisions must follow the risk management strategy, as NIST SP 800-39 requires.

The Senior Accountable Official for Risk Management must lead a risk executive function. Its members must include the CIO, the CISO, the Senior Agency Official for Privacy (SAOP), and Mission/Business Owners the official selects. The risk executive function must look at risk across all systems and missions and keep risk decisions consistent across the Organization. It must decide on any risk an Authorizing Official proposes to accept above the Organization’s risk tolerance. It must also make sure security and privacy planning, monitoring, and reporting work together, as OMB M-25-04 directs.

PM-30 — Supply Chain Risk Management Strategy #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Requirement:

1. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;
2. Implement the supply chain risk management strategy consistently across the organization; and
3. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency — to be defined] or as required, to address organizational changes.

Implementation guidance:

The CISO must develop an organization-wide supply chain risk management (SCRM) strategy: the Supply Chain Risk Management Strategy and Implementation Plan (PLAN-SCRM-001). The Senior Accountable Official for Risk Management must approve it. The strategy must cover the risks that arise when the Organization develops, buys, maintains, or disposes of systems, system components, and system services. It must state the Organization’s supply chain risk tolerance, the mitigations the Organization accepts, how the Organization evaluates and monitors supply chain risk, and who does what.

The CIO, System Owners, and Contracting Officers must apply the strategy in every system and every IT acquisition. Each system-level supply chain risk management plan must follow it. The CIO must take part in IT contract decisions, as OMB M-26-10 requires. The strategy must address software supply chain security, as Executive Order (EO) 14028 directs. The CISO must review and update the strategy on [PM-30 parameter 1 — to be defined], and sooner when the Organization’s structure or mission changes.

PM-30(1) — Suppliers of Critical or Mission-essential Items #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Requirement:

Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.

Implementation guidance:

System Owners must identify the suppliers that provide technologies, products, and services critical to their systems or mission-essential functions. The CISO must keep an organization-wide list of these suppliers. The CISO must rank them by the harm to the mission if the supplier failed or was compromised. High Value Asset suppliers come first, as OMB M-19-03 requires. The CISO must assess the highest-ranked suppliers first and use the results in the supply chain risk management strategy.

PM-31 — Continuous Monitoring Strategy #

Baselines: Privacy CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Requirement:

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics — to be defined]; b. Establishing [Assignment: organization-defined monitoring frequencies — to be defined] and [Assignment: organization-defined assessment frequencies — to be defined] for control effectiveness; c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d. Correlation and analysis of information generated by control assessments and monitoring; e. Response actions to address results of the analysis of control assessment and monitoring information; and f. Reporting the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles — to be defined] [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

The CISO must keep an organization-wide information security continuous monitoring strategy. The Senior Agency Official for Privacy (SAOP) must keep a privacy continuous monitoring strategy that works with it. Both strategies must track [PM-31 parameter 1 — to be defined]. Control owners must monitor these metrics at [PM-31 parameter 2 — to be defined]. Assessors must check control effectiveness at [PM-31 parameter 3 — to be defined]. The metrics must reflect the risk tolerance in the Organization’s risk management strategy.

The CISO’s staff must combine and analyze assessment and monitoring results across systems. System Owners must respond to each result that shows a weakness. They must either fix it or record it as a plan of action and milestones (POA&M) item in the GRC system. The CISO must keep the Organization’s POA&M at the program level. The CISO and SAOP must report the security and privacy status of systems to [PM-31 parameter 4 — to be defined]. This work supports the continuous monitoring that OMB M-25-04 and the Federal Information Security Modernization Act (FISMA) require.

PM-32 — Purposing #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Requirement:

Analyze [Assignment: organization-defined systems or system components — to be defined] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.

Implementation guidance:

System Owners must check that [PM-32 parameter 1 — to be defined] are used only for their intended purpose. Each System Owner must record the intended mission or business purpose of the system in the System Security and Privacy Plan (SSPP). The ISSO must compare the system’s actual use with that purpose at each reauthorization and before any significant change. The check must cover the services, connections, users, and data the system supports.

When a system supports a function outside its stated purpose, the System Owner must remove that use or get the Authorizing Official’s approval to keep it. If the use stays, the System Owner must update the SSPP and the system’s risk assessment. The CISO must apply this analysis first to High Value Assets, as OMB M-19-03 requires.

FISMA Reporting and Risk Escalation #

The Organization reports on its information security and privacy programs each year under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. 3554(c). The deadlines come from the current OMB FISMA guidance, now OMB M-25-04.

• The CISO must run the annual FISMA data call and prepare the CIO metrics. The CIO must approve them.
• The Senior Agency Official for Privacy (SAOP) must prepare the SAOP metrics and the privacy documents OMB requires. The SAOP must agree with the CIO on answers where the two overlap.
• The agency head must sign the annual letter to OMB on the adequacy and effectiveness of the information security program.
• The CIO must send the annual report to the congressional committees and the Government Accountability Office (GAO) by the date in the current OMB FISMA guidance.
• The CISO must submit the quarterly CIO metrics by the dates in the current OMB FISMA guidance.
• The CISO must support the Inspector General’s annual independent evaluation under 44 U.S.C. 3555.
• When a risk exceeds what an Authorizing Official may accept under the Risk Management Strategy, the CISO must refer it through the CIO to the risk executive function.
• The Senior Accountable Official for Risk Management must lead the risk executive function and record its decision to accept or reduce each referred risk.

Source: 44 U.S.C. 3554(c) and 3555; OMB M-25-04, Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 2025), sections IV through IX; NIST SP 800-37 Rev. 2, Appendix D (risk executive function); NIST SP 800-39.

Related Required Processes #

• The organization-level Risk Management Framework (RMF) Prepare tasks (P-1 through P-7) carry out the risk management strategy (PM-09) and the system inventory (PM-05). The Assessment, Authorization, and Monitoring procedure lists every RMF task and who does it. Task P-16 places each system in the enterprise architecture, which the Enterprise Architecture Policy and Procedure govern.
• Protection of CUI on contractor systems (PM-17) follows the contractor CUI section of the System and Services Acquisition policy and procedure.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of program management controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves program management through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Mature the executive cyber risk dashboard from static reporting to live metrics drawn directly from operational tooling.
6. Institutionalize an annual program self-assessment against the IG FISMA model ahead of the OIG audit.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• Capital planning and investment control process of each executive agency (40 U.S.C. § 11312).
• Executive Order 13694: Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities, April 1, 2015.
• Executive Order 13719: Establishment of the Federal Privacy Council, February 9, 2016.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Executive Order 14144: Strengthening and Promoting Innovation in the Nation’s Cybersecurity, January 16, 2025.
• Executive Order 14306: Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending EO 13694 and EO 14144, June 6, 2025.
• Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026.
• Executive Order 14434: Inaugurating the Era of Super Intelligence, September 29, 2026.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST IR 8286 Rev. 1: Integrating Cybersecurity and Enterprise Risk Management (ERM), December 18, 2025.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-39: Managing Information Security Risk: Organization, Mission, and Information System View, March 2011.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-11: Preparation, Submission, and Execution of the Budget, August 29, 2025.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.
• OMB M-19-23: Phase 1 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Learning Agendas, Personnel, and Planning Guidance, July 10, 2019.
• OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-25-05: Phase 2 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Open Government Data Access and Management Guidance, January 15, 2025.
• OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, April 3, 2025.
• OMB M-26-10: Reinforcing Transparency, Accountability, and Oversight of Federal Technology, March 31, 2026.