Program Management Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the PM control family policy (POL-PM). It covers every control in the program management family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the PM family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the low security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• GV.OC — Organizational Context (Govern function)
• GV.RM — Risk Management Strategy (Govern function)
• GV.RR — Roles, Responsibilities, and Authorities (Govern function)
• GV.PO — Policy (Govern function)
• GV.OV — Oversight (Govern function)
• ID.AM — Asset Management (Identify function)
• ID.RA — Risk Assessment (Identify function)
• ID.IM — Improvements (Identify function)
• PR.AT — Awareness and Training (Protect function)

3. Controls Covered #

This procedure covers the following 37 controls in the PM family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PM control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

OMB M-25-04: FY 2025 FISMA Guidance

• The organization must prioritize cybersecurity efforts aligned with EO 14028, the National Cybersecurity Strategy, and OMB cyber policy guidance. Resources must be focused on maturing zero trust architectures, implementing continuous monitoring, and modernizing legacy systems. Deadline: FY 2025. (OMB M-25-04, §1)
• The organization must ensure security and privacy coordination, integrating security and privacy planning, monitoring, and reporting. This coordination is essential for managing risk and complying with FISMA requirements. (OMB M-25-04, §4)

NIST SP 800-39: Managing Information Security Risk

• The organization must establish a risk management strategy that defines risk tolerance, priorities, and the approach for managing risk across the organization. This strategy must guide resource allocation and security investment decisions. (NIST SP 800-39, §2.1)

Executive Order 14028: Improving the Nation’s Cybersecurity

• The organization must modernize cybersecurity by adopting zero trust architecture, improving software supply chain security and detection and response, and removing barriers to sharing threat information. (EO 14028, §1)

OMB Circular A-130: Managing Information as a Strategic Resource

• The organization must manage information security as a continuous, risk-based program rather than a compliance exercise. Security and privacy must be integrated into the information lifecycle from planning through disposal. (OMB Circular A-130, §5)
• The organization must have the CIO review and approve every acquisition strategy, acquisition plan, and interagency agreement that includes IT before it is approved. (OMB Circular A-130, §5(d)(2))
• The organization must affirm in the initial budget submission to OMB that the CIO reviewed and approves the IT investments portion of the budget request, and that the SAOP reviewed it for privacy requirements and costs. (OMB Circular A-130, §5(a)(3)(e))
• The organization must have the CIO lead TechStat reviews or other performance reviews of IT investments; the CIO may recommend that the agency head modify, pause, or end an investment. (OMB Circular A-130, §5(b)(5))

FISMA Act of 2014

• The organization must develop, document, and implement an agency-wide information security program that includes risk assessments, policies, procedures, sub-plan integration, security awareness training, and continuous monitoring. (FISMA 2014, 44 U.S.C. § 3554)
• The organization must report each year on the adequacy and effectiveness of information security policies, procedures, and practices to OMB, DHS, Congress, and the Comptroller General. Deadline: Annually. (44 U.S.C. § 3554(c))

OMB M-19-03: Strengthening Cybersecurity through the High Value Asset Program

• The organization must designate accountable senior officials for HVA governance and integrate HVA identification, protection, and assessment activities into the agency-wide risk management and enterprise architecture programs. (OMB M-19-03, §B)

Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks

• The organization must the agency head identifies a PQC migration lead, an employee or detailee who reports to the CIO, and sends the lead’s name and contact details to the Director of OMB and the National Cyber Director within 30 days of the order. Deadline: 2026-07-22. (EO 14412, §4(a) and §2(h))

OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6)

• The organization must designate an agency-wide IPv6 integrated project team to lead the transition to IPv6. (OMB M-21-07)

OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy

• The organization must designate a Senior Agency Official for Privacy with the authority, independence, and resources to lead the agency-wide privacy program. (OMB M-16-24; EO 13719)

40 U.S.C. § 11312: Capital planning and investment control process of each executive agency

• The organization must run one capital planning and investment control process that selects, manages, and evaluates IT investments, including information security needs, and ties them to budget, financial, and program decisions. (40 U.S.C. § 11312)

OMB Circular A-11: Preparation, Submission, and Execution of the Budget

• The organization must conduct IT capital planning internally under OMB Circular A-130 and the Capital Programming Guide even when OMB does not require the agency to report its IT portfolio data. (OMB Circular A-11, §51.3(b))

OMB Circular A-123: Management’s Responsibility for Internal Control

• The organization must agency leadership defines the Organization’s objectives and develops its risk appetite and risk tolerance levels, and officials use them to decide how to respond to each risk. (OMB Circular A-123, §II.B)

OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust

• The organization should maintain Super Intelligence (SI) governance that names accountable officials (including a Chief AI Officer or equivalent), sets workforce expectations for appropriate SI use — especially where SI supports consequential decisions — and publishes an annual SI use-case inventory. Deadline: Annual SI use-case inventory. (OMB M-25-21, Appendix)

OMB M-26-10: Reinforcing Transparency, Accountability, and Oversight of Federal Technology

• The organization should collect and share vendor utilization and prices-paid data for IT contracts as OMB directs, and keep the CIO involved in agency IT contract decisions consistent with FITARA. (OMB M-26-10, §2)

NIST IR 8286 Rev. 1: Integrating Cybersecurity and Enterprise Risk Management (ERM)

• The organization should record cybersecurity risks in system and organization risk registers, and roll them up into the enterprise risk register for senior leaders. (NIST IR 8286 Rev. 1, §3.8)

OMB M-19-23: Phase 1 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018

• The organization should keep a Data Governance Body that the Chief Data Officer chairs, with senior staff from business units, data functions, and financial management. (OMB M-19-23)

OMB M-25-05: Phase 2 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Open Government Data Access and Management Guidance

• The organization should keep a comprehensive data inventory of all data assets. Add each new data asset within 90 days and review the whole inventory at least once a year. Deadline: Within 90 days of a new data asset; at least yearly. (OMB M-25-05)

EO 14434: Inaugurating the Era of Super Intelligence

• The organization should use the terms Super Intelligence and SI in place of artificial intelligence and AI in the Organization’s policies, procedures, plans, reports, and other non-statutory documents. Keep the titles of earlier sources, statutory terms, and quoted text as published. (EO 14434, §§ 2(a)-(b), 3(a))

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the PM controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Program Management family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The CISO / Chief Information Officer (CIO) carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the PM policy (POL-PM) for the role definitions.

4.2 Control-Specific Procedures #

PM-01 — Information Security Program Plan #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.OC (Organizational Context), GV.RR (Roles, Responsibilities, and Authorities), GV.PO (Policy)

1. Develop and disseminate an organization-wide information security program plan that:

1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
3. Reflects the coordination among organizational entities responsible for information security; and
4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;

2. Review and update the organization-wide information security program plan [Assignment: organization-defined frequency — to be defined] and following [Assignment: organization-defined events — to be defined]; and
3. Protect the information security program plan from unauthorized disclosure and modification.

Procedure:

The CISO’s staff draft the Information Security Program Plan in the document management system. They take the list of common controls and their providers from the governance, risk, and compliance (GRC) system and add it to the plan as an appendix. They ask the CIO, the Senior Agency Official for Privacy (SAOP), and System Owners to confirm the roles and coordination steps the plan describes. The CISO reviews the draft and sends it to the Senior Accountable Official for Risk Management, who signs the approval record.

The CISO’s staff publish the approved plan in the document management system. They send a notice to the CIO, the SAOP, Authorizing Officials, System Owners, and Information System Security Officers (ISSOs). Only the CISO’s staff hold edit rights to the plan, and they keep each release in its version history.

The CISO starts a review [PM-01 parameter 1 — to be defined]. The CISO also starts a review after [PM-01 parameter 2 — to be defined], after an audit finding against the program, or after a major incident or breach.

Evidence: the signed approval record, the version history and edit rights list in the document management system, the distribution notice, and the record of each review.

PM-02 — Information Security Program Leadership Role #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.OC (Organizational Context), GV.RR (Roles, Responsibilities, and Authorities)

Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.

Procedure:

When the CISO position is vacant, the CIO selects a candidate with Human Resources. The CIO issues a written designation that names the person and states the CISO’s duties and authority. The CIO’s staff file the signed designation in the document management system and send a notice to Authorizing Officials, System Owners, and ISSOs. If the CISO is absent for an extended period, the CIO designates an acting CISO in writing in the same way.

The CISO sets up the office and assigns staff to policy, authorization, and continuous monitoring work. The CISO keeps the program’s policies and procedures in the document management system and the authorization records in the GRC system. For each budget cycle, the CISO prepares a resource request for the program and sends it to the CIO. The CISO briefs the CIO on program status, open risks, and resource needs, and records each briefing.

Evidence: the signed CISO designation, the distribution notice, any acting CISO designation, the program resource requests, and the briefing records.

PM-03 — Information Security and Privacy Resources #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

1. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
2. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
3. Make available for expenditure, the planned information security and privacy resources.

Procedure:

At the start of each budget cycle, the CIO’s staff send System Owners the capital planning call. Each System Owner works with the ISSO to estimate the security and privacy costs for the system. They base the estimate on open plan of action and milestones (POA&M) items in the GRC system and on the system’s continuous monitoring needs.

The CISO and the SAOP review each estimate, add program-level costs, and record their concurrence. If a request leaves out these costs, the System Owner writes an exception with the reason. The CIO decides whether to approve the exception, and the CIO’s staff keep the decision with the investment record.

After funds arrive, the CIO’s staff release the planned security and privacy amounts to the responsible offices. The CISO compares spending with the plan and reports any shortfall to the CIO.

Evidence: the investment requests with security and privacy cost lines, the CISO and SAOP concurrence records, the approved exceptions, and the spending comparison reports.

PM-04 — Plan of Action and Milestones Process #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

1. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:

1. Are developed and maintained;
2. Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
3. Are reported in accordance with established reporting requirements.

2. Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Procedure:

The ISSO enters each finding from an assessment, continuous monitoring, an audit, or an incident into the GRC system as a POA&M item. The ISSO assigns an owner and a due date and links the item to the affected system. The CISO’s staff enter program-level items, such as weaknesses in a common control or in the supply chain risk management program. The Privacy Officer enters privacy program items for the SAOP.

Before each FISMA reporting cycle, the CISO’s staff review open items in the GRC system. They compare each item with the risk tolerance and priorities in the risk management strategy. They ask owners to re-plan items whose fix or due date conflicts with those priorities. The CISO sends the CIO a POA&M status report and submits the POA&M data that FISMA reporting requires.

Evidence: the POA&M items in the GRC system with owners and dates, the CISO’s staff review notes, the status report to the CIO, and the submitted FISMA data.

PM-05 — System Inventory #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), ID.AM (Asset Management)

Develop and update [Assignment: organization-defined frequency — to be defined] an inventory of organizational systems.

Procedure:

A System Owner who plans a new system opens an inventory entry in the GRC system before categorization starts. The entry names the system, its owner, its ISSO, its Authorizing Official, and its proposed boundary. The ISSO checks that the boundary covers resources under common management control with a shared mission, similar security needs, and one operating environment. If the system is a subsystem, the ISSO links the entry to its parent system.

The CISO’s staff review the full inventory [PM-05 parameter 1 — to be defined]. They compare it with authorization packages and open POA&M items in the GRC system, and they ask System Owners to correct missing or stale entries. When a system transfers or merges, the System Owner updates the entry, and the ISSO notifies the Authorizing Official, who reopens the authorization. When a system retires, the System Owner marks the entry retired and records the disposal date.

Evidence: the inventory and its change history in the GRC system, each inventory review record signed by the CISO’s staff, boundary records for each system, and reopened authorization records for transferred or merged systems.

PM-05(1) — Inventory of Personally Identifiable Information #

Baselines: Privacy

Establish, maintain, and update [Assignment: organization-defined frequency — to be defined] an inventory of all systems, applications, and projects that process personally identifiable information.

Procedure:

The Privacy Officer keeps the personally identifiable information (PII) inventory in the GRC system as part of the system inventory, with a flag on each entry that processes PII. In each entry the SAOP records the PII types, the purpose, and the related privacy impact assessment and system of records notice. The Privacy Officer reviews the inventory with System Owners [PM-05(1) parameter 1 — to be defined]. During the review, System Owners confirm each purpose and remove PII they no longer need. The SAOP signs the completed review.

Evidence: the flagged inventory entries in the GRC system and the SAOP-signed review record.

PM-06 — Measures of Performance #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), GV.OV (Oversight), ID.IM (Improvements)

Develop, monitor, and report on the results of information security and privacy measures of performance.

Procedure:

The CISO’s staff and the Privacy Officer keep the list of measures, with definitions and targets, in the document management system. Each measure draws data from a named source, such as authorization status, POA&M aging, and assessment results in the GRC system. The measure owner collects the data for each reporting period and records the result.

The CISO and SAOP review the results together and compare them with targets. They brief the CIO and the Senior Accountable Official for Risk Management on trends and misses. For each missed target, the measure owner opens a program-level POA&M item in the GRC system with an owner and a due date. The CISO’s staff use the results in the annual FISMA report and update measures when the risk management strategy changes.

Evidence: the measures list in the document management system, recorded results for each period, briefing records, program-level POA&M items in the GRC system, and the measures section of the annual FISMA report.

PM-07 — Enterprise Architecture #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Procedure:

The Chief Architect keeps the enterprise architecture in the document management system under the Enterprise Architecture Procedure. The CISO’s staff add the security architecture, and the Privacy Officer adds the privacy architecture. Both describe shared security and privacy services, trust zones, and data flows that involve personally identifiable information.

When a System Owner proposes a new system or a major change, the Architecture Review Board checks the design against the enterprise architecture, following the Enterprise Architecture Procedure. The ISSO confirms that the system security and privacy plan in the GRC system matches the security architecture. The Privacy Officer confirms that the design matches the privacy architecture. The CIO, CISO, and SAOP decide on any proposed exception and record the decision and its risk.

The Chief Architect updates the architecture when an approved change alters a shared service, a trust zone, or the list of high value assets.

Evidence: architecture versions and change history in the document management system, Architecture Review Board decisions, exception decisions with risk statements, and system security and privacy plans in the GRC system.

PM-07(1) — Offloading #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Offload [Assignment: organization-defined non-essential functions or services — to be defined] to other systems, system components, or an external provider.

Procedure:

During system design and at each major change, the ISSO lists the functions each system performs and marks those that are not essential to the mission. The System Owner moves each marked function to a separate system, component, or external provider. The ISSO records the move and the receiving system in the system security and privacy plan in the GRC system. If a function cannot move, the System Owner records the reason and a POA&M item in the GRC system.

Evidence: function lists and plan updates in the GRC system, CIO approvals for external providers, and related POA&M items.

PM-08 — Critical Infrastructure Plan #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy)

Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.

Procedure:

The CIO assigns a plan lead, who keeps the plan in the document management system. The plan lead asks the CISO’s staff and the Privacy Officer for content at the start of each update. The CISO’s staff pull the supporting systems, their categorization, and their authorization status from the system inventory in the GRC system. They also list the high value assets and their protection measures. The Privacy Officer describes the personally identifiable information these systems process and the privacy protections that apply.

The plan lead combines the content and sends the draft to the CISO and SAOP for review. The CISO and SAOP record their concurrence. The CIO approves the plan. The plan lead publishes the approved version in the document management system and tells System Owners of supporting systems.

When the high value asset list or a supporting system boundary changes, the CISO’s staff notify the plan lead, who starts an update.

Evidence: plan versions with approval and review records in the document management system, CISO and SAOP concurrence records, and the system and high value asset data from the GRC system.

PM-09 — Risk Management Strategy #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), GV.OV (Oversight), ID.IM (Improvements)

1. Develops a comprehensive strategy to manage:

1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;

2. Implement the risk management strategy consistently across the organization; and
3. Review and update the risk management strategy [Assignment: organization-defined frequency — to be defined] or as required, to address organizational changes.

Procedure:

The CISO’s staff and the Privacy Officer draft the Risk Management Strategy (PLAN-RMS-001) and keep it in the document management system. The draft states assumptions about threats and resources, constraints, priorities, and risk tolerance for security and privacy. The CIO and SAOP review the draft. The Senior Accountable Official for Risk Management recommends it after the risk executive function meets, and the agency head approves it.

Authorizing Officials record each risk acceptance in the GRC system and compare the risk with the stated tolerance. If the risk exceeds tolerance, the ISSO sends the record to the CISO. The CISO adds a recommendation and forwards it to the CIO. The CIO forwards it to the risk executive function, which decides and records the decision in the GRC system.

The CISO’s staff start a review [PM-09 parameter 1 — to be defined] and after a major organizational change. They update the strategy with lessons from risk decisions and performance results.

Evidence: approved strategy versions in the document management system, risk executive function meeting records, risk acceptance and escalation records in the GRC system, and review records.

PM-10 — Authorization Process #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.OV (Oversight)

1. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
2. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
3. Integrate the authorization processes into an organization-wide risk management program.

Procedure:

The Assessment, Authorization, and Monitoring procedure lists each task of the Risk Management Framework in NIST SP 800-37 Revision 2. The CISO’s staff record role assignments for each system in the GRC system when the System Owner registers the system. The ISSO prepares the authorization package in the GRC system, including the system security and privacy plan, the assessment results, and the POA&M. For systems that process personally identifiable information, the Privacy Officer reviews the package and the SAOP records agreement with the privacy risk.

The Authorizing Official reviews the package and records the authorization decision in the GRC system. If the residual risk exceeds the agency risk tolerance, the CISO sends the decision to the risk executive function. After authorization, the ISSO feeds continuous monitoring results into the GRC system. The Authorizing Official reviews them and decides whether the authorization stays in force.

Evidence: role assignments, authorization packages, SAOP privacy agreements, decision records, and continuous monitoring reports in the GRC system.

PM-11 — Mission and Business Process Definition #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context)

1. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
2. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
3. Review and revise the mission and business processes [Assignment: organization-defined frequency — to be defined].

Procedure:

The Mission/Business Owner writes each process definition and stores it in the document management system. The definition describes the process steps, the information types, and any PII the process collects, uses, shares, or keeps. The CISO’s staff identify the harm that a loss of confidentiality, integrity, or availability would cause. The Privacy Officer completes a privacy risk assessment and notes any PII the process does not need.

The Mission/Business Owner records the agreed protection and PII processing needs with the definition. System Owners link supporting systems to the process in the GRC system and use the needs to categorize each system. The CISO’s staff copy the agreed needs into the Target Profile in the Cybersecurity Framework Organizational Profile Template (TMPL-CSF-001).

The Mission/Business Owner starts a review [PM-11 parameter 1 — to be defined] and whenever a process changes. The CISO’s staff and the Privacy Officer update the needs, and System Owners revisit categorization if the needs change.

Evidence: process definitions and review history in the document management system, privacy risk assessments, and system links and categorizations in the GRC system.

PM-12 — Insider Threat Program #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.OC (Organizational Context), GV.RM (Risk Management Strategy), ID.RA (Risk Assessment)

Implement an insider threat program that includes a cross-discipline insider threat incident handling team.

Procedure:

The senior official keeps the program plan and team charter in the document management system. Any employee or supervisor may report a concern to the team. The Security Operations Center refers technical indicators, such as unusual data transfers or account misuse. Human Resources refers relevant personnel actions and conduct concerns.

The team reviews each referral together. General Counsel confirms the legal basis before the team reviews personnel records or asks for added monitoring. The SAOP confirms that the review uses only the personally identifiable information it needs. The team records its findings and recommends an action, such as closure, a security incident, a personnel action, or a referral to the Inspector General or law enforcement. The senior official approves the recommendation.

The senior official assesses the program against the plan and updates it with lessons from closed cases.

Evidence: the program plan and charter in the document management system, referral and case records with approvals, General Counsel and SAOP review records, training completion records, and program assessments.

PM-13 — Security and Privacy Workforce #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), PR.AT (Awareness and Training)

Establish a security and privacy workforce development and improvement program.

Procedure:

The CISO’s staff and the Privacy Officer keep a role catalog in the document management system. In the catalog the CISO and the SAOP record each security and privacy role, its duties, and the knowledge, skills, abilities, and training it requires. Human Resources uses the catalog when it writes position descriptions and screens applicants.

When a person enters a security or privacy role, the supervisor compares the person’s skills with the catalog. The supervisor sets a development plan with the required role-based training and any certification the role requires. Privacy roles receive role-based privacy training from the Privacy Officer. The supervisor confirms completion and updates the plan when the role changes.

The CISO’s staff and the Privacy Officer review the catalog when duties change. They compare staffing and skills with the catalog and report open positions and skill gaps to the CISO and SAOP. The CISO and SAOP brief the CIO on gaps and planned actions.

The Role-Based Training and Cybersecurity Workforce Plan (PLAN-WF-001) gives the steps for position coding, the yearly skills assessment, and the gap report.

Evidence: the role catalog in the document management system, position descriptions, development plans, training completion records, and gap reports to the CIO.

PM-14 — Testing, Training, and Monitoring #

Baselines: Privacy CSF 2.0: GV.OC (Organizational Context), GV.OV (Oversight)

1. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:

1. Are developed and maintained; and
2. Continue to be executed; and

2. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Procedure:

The CISO’s staff keep the security testing, training, and monitoring plan in the document management system with its version history. The SAOP’s staff keep the privacy plan in the same library. In each plan the owner records control assessments, incident and breach response exercises, role-based training, and continuous monitoring tasks, with an owner and a planned date for each task.

System Owners record completed assessments and their results in the GRC system with the system’s authorization package. Each finding becomes a plan of action and milestones (POA&M) item in the GRC system. The Information System Security Officer (ISSO) assigns an owner and a due date to each item. The CISO’s staff collect completion records for role-based security training, and the SAOP’s staff collect them for privacy training.

When the risk management strategy changes, the CISO and the SAOP compare each plan with the new risk tolerance and response priorities. They record the result of the comparison, revise the plan where needed, and publish the new version in the document management system. The CISO reports the status of both plans to the Chief Information Officer (CIO).

Evidence: the current plans and their versions in the document management system; assessment results and POA&M items in the GRC system; training records; exercise after-action reports; and each signed plan comparison.

PM-15 — Security and Privacy Groups and Associations #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Establish and institutionalize contact with selected groups and associations within the security and privacy communities: a. To facilitate ongoing security and privacy education and training for organizational personnel; b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and c. To share current security and privacy information, including threats, vulnerabilities, and incidents.

Procedure:

The CISO’s staff keep the membership list in the document management system. Each entry names the group, the reason for joining, the point of contact, and the date of the last review. The SAOP’s staff add privacy groups to the same list.

Points of contact attend group meetings and read group notices. They report new methods, tools, and training offers to the CISO or the SAOP. The CISO decides which methods to adopt and assigns any needed policy change to the owner of that policy. Points of contact pass threat, vulnerability, and incident reports to the Security Operations Center for action.

Before a point of contact shares Organization information with a group, the point of contact sends the item to the CISO. The CISO approves or rejects the release. For a privacy item, the SAOP must also approve it. The point of contact files each decision with the membership record in the document management system.

The CISO reviews the list when the mission or the main threats change. The CISO ends memberships that no longer support the Organization and assigns a new point of contact when one leaves.

Evidence: the membership list with review dates in the document management system, approved and rejected release requests, meeting notes from points of contact, and the record of methods the CISO adopted.

PM-16 — Threat Awareness Program #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

Procedure:

The Security Operations Center (SOC) receives threat reports from the sources on the approved source list. An analyst rates each report for its relevance to the Organization’s systems. The analyst sends each relevant warning to the affected System Owners and ISSOs and logs the warning in the SOC case record.

The ISSO confirms whether the system is exposed and records the response. If the System Owner cannot fix the system at once, the ISSO opens a plan of action and milestones (POA&M) item in the GRC system with an owner and a due date.

When the SOC observes a new attack method or indicator, an analyst prepares a sharing report. The CISO approves the release, and General Counsel reviews any report that carries restricted information. The SOC then sends the report to the partners named in the sharing agreement.

The CISO’s staff keep the program description, the approved source list, and the sharing agreements in the document management system. The CISO briefs the Chief Information Officer (CIO) on threat trends and updates the risk assessment with them.

Evidence: the source list and sharing agreements in the document management system; SOC case records; POA&M items in the GRC system; approved sharing reports; and the CISO’s threat briefings to the CIO.

PM-16(1) — Automated Means for Sharing Threat Intelligence #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

Procedure:

The SOC connects each approved threat feed to its detection tools through an automated interface. Indicators from the feed reach the detection rules without manual entry. An analyst checks that each feed is current and opens a SOC case when a feed fails.

When the SOC confirms a new indicator in the Organization’s environment, the analyst submits it for release. After the CISO approves, the SOC sends it to partners through the same automated channel. The CISO’s staff record each feed, its source, and its sharing agreement in the document management system.

Evidence: the feed list in the document management system, SOC cases for feed failures, approved release requests, and partner delivery records.

PM-17 — Protecting Controlled Unclassified Information on External Systems #

Baselines: Privacy

1. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
2. Review and update the policy and procedures [Assignment: organization-defined frequency — to be defined].

Procedure:

When a contract or agreement will place Controlled Unclassified Information (CUI) on an outside system, the System Owner tells the Contracting Officer and the CISO before award. The Contracting Officer adds the CUI terms to the contract. The CISO’s staff confirm that the contractor or partner has described how it will meet those terms. The System Owner then records the outside system, the CUI categories, and the agreement in the GRC system.

The Information System Security Officer (ISSO) reviews the security reports the contract requires from the outside party. The ISSO records each gap as a plan of action and milestones (POA&M) item in the GRC system. When the agreement ends, the System Owner obtains written confirmation that the outside party returned or destroyed the CUI. The System Owner files that confirmation in the GRC system.

The CISO’s staff review the policy [PM-17 parameter 1 — to be defined] and this procedure [PM-17 parameter 2 — to be defined]. They resolve reviewer comments and publish each new version in the document management system.

Evidence: contract clauses for CUI, outside system records and agreements in the GRC system, POA&M items, return or destruction confirmations, and the review and approval history in the document management system.

PM-18 — Privacy Program Plan #

Baselines: Privacy

1. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:

1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and

2. Update the plan [Assignment: organization-defined frequency — to be defined] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

Procedure:

The Privacy Officer drafts the privacy program plan and its appendix of common privacy controls. The Privacy Officer works with the CISO’s staff so the plan matches the security program plan. The CISO’s staff store drafts and released versions in the document management system. General Counsel reviews each draft for legal accuracy.

The SAOP reviews the draft, resolves comments, and signs the approval. The Privacy Officer publishes the approved plan in the document management system and notifies System Owners, Information System Security Officers (ISSOs), and privacy staff. System Owners use the plan to see which privacy controls their systems inherit. They address the rest in their System Security and Privacy Plan (SSPP).

The Privacy Officer starts a revision on this schedule: [PM-18 parameter 1 — to be defined]. The Privacy Officer also starts one when federal privacy law or the Office of Management and Budget (OMB) policy changes, when the Organization reorganizes, or when a privacy control assessment finds a problem. Each revision follows the same review and approval steps.

Evidence: the signed plan and its version history in the document management system, the comment record, the distribution notice, and the assessment findings that led to each revision.

PM-19 — Privacy Program Leadership Role #

Baselines: Privacy

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.

Procedure:

The agency head signs an appointment memorandum that names the SAOP and states the official’s authority and resources. The Privacy Officer files the memorandum in the document management system. The Privacy Officer then notifies the Chief Information Officer (CIO), the CISO, General Counsel, and System Owners of the appointment.

Before a project develops or buys a system that will handle PII, the System Owner completes a privacy threshold analysis. If the analysis shows the system handles PII, the System Owner prepares a privacy impact assessment (PIA), and the SAOP reviews and approves it. During authorization, the SAOP reviews the privacy controls in the System Security and Privacy Plan and the privacy findings. The SAOP records agreement to the privacy risk in the GRC system before the Authorizing Official signs.

The SAOP prepares the privacy section of the annual FISMA report with the CISO and briefs the agency head on privacy risk. When the SAOP leaves the role, the agency head names a successor or an acting official. The Privacy Officer then updates the appointment record.

Evidence: the signed appointment memorandum in the document management system, approved PIAs, SAOP risk agreements in the GRC system, the privacy section of the FISMA report, and briefing records.

PM-20 — Dissemination of Privacy Program Information #

Baselines: Privacy

Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that: a. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy; b. Ensures that organizational privacy practices and reports are publicly available; and c. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Procedure:

The Privacy Officer keeps a list of every document the privacy page must carry, stored in the document management system. When the SAOP approves a new or revised privacy impact assessment, system of records notice (SORN), matching agreement, or report, the Privacy Officer adds it to the list. The Privacy Officer then sends the document to the System Owner of the public website for posting.

After each posting, the Privacy Officer checks the page to confirm the link works and the version is current. The Privacy Officer records the posting date on the list.

Privacy staff log each question or complaint that arrives by the public email address or phone line. They answer each one and send any matter about a specific system to its System Owner. They refer any matter that needs a policy decision to the SAOP. The Privacy Officer reports the volume and type of contacts to the SAOP.

Evidence: the content list with posting dates in the document management system, the published page, the log of public questions and complaints with their responses, and the Privacy Officer’s reports to the SAOP.

PM-20(1) — Privacy Policies on Websites, Applications, and Digital Services #

Baselines: Privacy

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that: (a) Are written in plain language and organized in a way that is easy to understand and navigate; (b) Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and (c) Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.

Procedure:

Before a public website, app, or digital service goes live, the System Owner sends a draft privacy policy to the Privacy Officer. The Privacy Officer checks it against the plain-language standard and the service’s actual data practices. General Counsel reviews any content that federal law requires, and the SAOP approves the final text.

The System Owner posts the policy with its date and records the link in the system security and privacy plan in the GRC system. When practices change, the System Owner tells the Privacy Officer before the change takes effect, and the same steps repeat.

Evidence: each dated policy version, the SAOP approval, the plan entry in the GRC system, and captures of the posted policy links.

PM-21 — Accounting of Disclosures #

Baselines: Privacy

1. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:

1. Date, nature, and purpose of each disclosure; and
2. Name and address, or other contact information of the individual or organization to which the disclosure was made;

2. Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and
3. Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.

Procedure:

When staff release PII from a system of records outside the Organization, they record the release in that system’s disclosure log. The entry shows the date, the records released, the reason, and the recipient’s contact information. The System Owner keeps the log and protects it with the same controls as the records themselves.

When a person asks for the list of disclosures about them, the Privacy Officer verifies the person’s identity. The Privacy Officer then asks the System Owner for the relevant entries. General Counsel advises whether any entry may be withheld. The Privacy Officer sends the response and keeps a copy with the request.

If the Organization later corrects a record, the System Owner uses the log to tell each earlier recipient about the correction. During each privacy control assessment, the Privacy Officer samples log entries to confirm they are complete. The Privacy Officer records any gap as a plan of action and milestones item in the GRC system.

Evidence: the disclosure logs with retention dates, individual requests and responses, correction notices to recipients, assessment samples, and related plan of action items in the GRC system.

PM-22 — Personally Identifiable Information Quality Management #

Baselines: Privacy

Develop and document organization-wide policies and procedures for: a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b. Correcting or deleting inaccurate or outdated personally identifiable information; c. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d. Appeals of adverse decisions on correction or deletion requests.

Procedure:

The System Owner describes the quality checks for each system in its System Security and Privacy Plan in the GRC system. Checks include source validation at collection and a review of PII before the system uses it to decide something about a person.

A person sends a correction or deletion request to the privacy office. The Privacy Officer logs the request, verifies the person’s identity, and sends it to the Information Owner. The Information Owner decides whether to correct or delete the data and records the reason. If the Information Owner makes the change, the System Owner applies it. The Privacy Officer then notifies the person and each earlier recipient named in the disclosure log.

If the Information Owner denies the request, the Privacy Officer sends the person a written decision. The decision gives the reasons and explains how to file a statement of disagreement and an appeal. The SAOP or the named appeal official decides the appeal and records the result.

Evidence: the quality checks in each plan in the GRC system, the request log, decision letters, notices to recipients, statements of disagreement, and appeal decisions.

PM-23 — Data Governance Body #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Establish a Data Governance Body consisting of [Assignment: organization-defined roles — to be defined] with [Assignment: organization-defined responsibilities — to be defined].

Procedure:

The SAOP keeps the charter, membership list, and meeting records of the Data Governance Body in the document management system. The SAOP sets each agenda and calls a meeting when a matter needs a decision.

The Privacy Officer brings each new system or data collection that involves PII to the body. The members confirm the privacy impact assessment is complete and decide whether a new or revised SORN is needed. The Privacy Officer drafts any SORN and checks that it includes the breach routine uses. The Privacy Officer publishes it after the SAOP approves.

The body reviews each request to release data outside the Organization. The members decide whether the data needs de-identification, approve or deny the release, and record the terms. The body also sets retention periods and consent notice text for PII collections and sends them to the affected System Owners.

The SAOP records each decision in the meeting minutes. The SAOP shares decisions that affect security with the CISO and the CIO.

Evidence: the charter and minutes in the document management system, approved SORNs, data release decisions with their terms, and retention and consent notice decisions.

PM-24 — Data Integrity Board #

Baselines: Privacy

Establish a Data Integrity Board to: a. Review proposals to conduct or participate in a matching program; and b. Conduct an annual review of all matching programs in which the agency has participated.

Procedure:

A program office that wants to start or renew a computer matching program sends a written proposal to the Privacy Officer. The proposal includes the draft matching agreement, the systems of records involved, and a cost-benefit analysis. The Privacy Officer checks that each system of records notice allows the disclosure. General Counsel reviews the legal authority for the match. The SAOP then places the proposal on the board’s agenda.

The Data Integrity Board reviews the proposal and votes to approve or disapprove it. The Privacy Officer records the decision and any conditions in the meeting minutes. The board chair signs an approved agreement before any records change hands.

After each calendar year ends, the Privacy Officer lists every matching program that was active during the year. For each program, the board checks whether the parties followed the agreement and verified match results before acting on them. The board also checks whether individuals received the required notice. The board then decides to continue, change, or end the program. The SAOP sends the signed annual review report to the agency head.

Evidence: each matching proposal and signed agreement, the General Counsel review, the board’s signed minutes and decisions, the list of active programs, and the signed annual review report.

PM-25 — Minimization of Personally Identifiable Information Used in Testing, Training, and Research #

Baselines: Privacy

1. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;
2. Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;
3. Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and
4. Review and update policies and procedures [Assignment: organization-defined frequency — to be defined].

Procedure:

A project lead who plans internal testing, training, or research first tries to meet the need with synthetic or masked data. If real PII is still needed, the project lead sends a request to the Privacy Officer. The request names the purpose, the data elements, the number of records, the environment, the people who will have access, and the end date.

The Privacy Officer compares the request with the system of records notice and privacy impact assessment for the source system. The Privacy Officer removes any data elements the purpose does not need. General Counsel advises when the new use may not fit the original purpose of collection. The SAOP approves or denies the request in writing.

Before anyone loads the data, the System Owner of the receiving environment confirms that it has the security controls the source system requires. At the approved end date, the project lead deletes or returns the PII and sends a disposal confirmation to the Privacy Officer. The Privacy Officer tracks open approvals and follows up on any that pass their end date.

Evidence: each request, the Privacy Officer’s minimization review, the SAOP’s signed decision, the System Owner’s environment confirmation, and the disposal confirmation.

PM-26 — Complaint Management #

Baselines: Privacy

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: a. Mechanisms that are easy to use and readily accessible by the public; b. All information necessary for successfully filing complaints; c. Tracking mechanisms to ensure all complaints received are reviewed and addressed within [Assignment: organization-defined time period — to be defined]; d. Acknowledgement of receipt of complaints, concerns, or questions from individuals within [Assignment: organization-defined time period — to be defined]; and e. Response to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period — to be defined].

Procedure:

When a complaint, concern, or question arrives through any public channel, the Privacy Officer logs it with the date received, the channel, and the topic. The Privacy Officer sends the individual an acknowledgement within [PM-26 parameter 3 — to be defined] of receiving it.

The Privacy Officer reviews each logged item within [PM-26 parameter 1 — to be defined] of receiving it and assigns an owner. Privacy questions stay with the Privacy Officer. Security questions go to the CISO, and items about a specific system go to its System Owner. If a complaint suggests a breach, the Privacy Officer reports it to the SAOP and the Security Operations Center under the incident response procedure. The owner addresses the item within [PM-26 parameter 2 — to be defined] of the assignment and records the action taken in the log.

The Privacy Officer sends the individual a response within [PM-26 parameter 4 — to be defined] of receiving the item. If the full answer needs more time, the response says what has been done so far and when the next update will come. The Privacy Officer limits access to the log to the people who handle complaints, because complaints often contain PII. The SAOP reviews open and overdue items with the Privacy Officer.

Evidence: the complaint log with dates received, acknowledged, reviewed, addressed, and answered; the acknowledgement and response messages; breach referrals; and the SAOP’s review notes.

PM-27 — Privacy Reporting #

Baselines: Privacy

1. Develop [Assignment: organization-defined privacy reports — to be defined] and disseminate to:

1. [Assignment: organization-defined oversight bodies — to be defined] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and
2. [Assignment: organization-defined officials — to be defined] and other personnel with responsibility for monitoring privacy program compliance; and

2. Review and update privacy reports [Assignment: organization-defined frequency — to be defined].

Procedure:

Each year, the Privacy Officer starts the privacy report when OMB issues its FISMA reporting instructions. The Privacy Officer collects data from System Owners and from privacy program records. These records include privacy impact assessments, system of records notices, computer matching agreements, complaints, breaches, and privacy training completion.

The Privacy Officer drafts the privacy section of the FISMA report and any other required privacy report. The CISO’s staff compare shared figures, such as system counts and incident totals, with the security section and resolve differences. General Counsel reviews the draft for legal reporting requirements. The SAOP approves the final report and submits it to OMB by the OMB deadline.

After submission, the SAOP sends the report to the CIO and the other officials named in this policy. The Privacy Officer records each gap the report shows as an action item for the privacy program plan. The Privacy Officer assigns an owner and a due date to each item, and the SAOP tracks progress through the next reporting cycle.

Evidence: the data requests and responses, the draft with General Counsel comments, the SAOP’s approval, the OMB submission confirmation, the distribution record, and the action items with owners and due dates.

PM-28 — Risk Framing #

Baselines: Privacy

1. Identify and document:

1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
2. Constraints affecting risk assessments, risk responses, and risk monitoring;
3. Priorities and trade-offs considered by the organization for managing risk; and
4. Organizational risk tolerance;

2. Distribute the results of risk framing activities to [Assignment: organization-defined personnel — to be defined]; and
3. Review and update risk framing considerations [Assignment: organization-defined frequency — to be defined].

Procedure:

The CISO’s staff draft the risk framing statement for the risk executive function. They gather input from Mission/Business Owners, System Owners, the SAOP, and the CIO. The draft lists the threat and resource assumptions, the legal, budget, and schedule constraints, the mission priorities and trade-offs, and the risk tolerance for security and privacy.

The risk executive function reviews the draft, resolves differences, and sends it to the Senior Accountable Official for Risk Management. That official approves the statement. The CISO’s staff publish it in the document management system as part of the Risk Management Strategy and send it to the officials named in this policy.

Authorizing Officials and System Owners use the statement when they assess and accept risk for their systems. When an Authorizing Official proposes a risk acceptance above the stated tolerance, the ISSO records the proposal in the GRC system. The CISO and the CIO add their recommendations. The risk executive function reviews it, and the Senior Accountable Official for Risk Management approves or rejects it.

The CISO’s staff start a review on schedule or when the system boundary, information types, or mission objectives change significantly.

Evidence: the approved statement with its version history and distribution record in the document management system, the escalated risk acceptances with decisions in the GRC system, and the risk executive function’s meeting records.

PM-29 — Risk Management Program Leadership Roles #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

1. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
2. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.

Procedure:

The agency head signs an appointment memorandum that names the Senior Accountable Official for Risk Management. The appointed official issues a charter for the risk executive function. The charter lists the members, the meeting schedule, and how the function records its decisions. The CISO’s staff keep the memorandum and the charter in the document management system.

Before each meeting, the CISO’s staff prepare a summary of risk across the Organization from the GRC system. The summary covers open POA&M items, risk acceptances, authorization status, and High Value Asset findings. The SAOP adds privacy risks. The members review the summary, compare risks across systems, and decide on any risk acceptance an Authorizing Official has escalated.

The Senior Accountable Official for Risk Management gives the CIO the risk priorities to use in capital planning and budget requests. The CISO’s staff record each decision and action item in the meeting minutes and enter escalated risk decisions in the GRC system.

Evidence: the signed appointment memorandum, the charter, the risk summaries, the signed meeting minutes, the escalated risk acceptance decisions in the GRC system, and the risk priorities sent to the CIO.

PM-30 — Supply Chain Risk Management Strategy #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

1. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;
2. Implement the supply chain risk management strategy consistently across the organization; and
3. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency — to be defined] or as required, to address organizational changes.

Procedure:

The CISO’s staff draft the Supply Chain Risk Management Strategy and Implementation Plan (PLAN-SCRM-001) with input from the CIO, Contracting Officers, General Counsel, and Mission/Business Owners. The plan holds the supply chain risk management (SCRM) roles, supplier tiers, Federal Acquisition Supply Chain Security Act (FASCSA) order steps, and milestones. The draft states the risk tolerance and links it to the Organization’s risk framing statement. It lists the acceptable mitigations, the supplier review steps, and the roles of each office.

The risk executive function reviews the draft. The Senior Accountable Official for Risk Management approves it. The CISO’s staff publish the approved strategy in the document management system and notify System Owners and Contracting Officers.

System Owners write a system-level supply chain risk management plan that follows the strategy and store it with the authorization package in the GRC system. Before an IT acquisition goes forward, the Contracting Officer and the System Owner confirm that the solicitation includes the supply chain requirements the strategy calls for. The CIO reviews IT contract actions before award.

The CISO’s staff start a review on schedule or when an organizational change affects supply chain risk. They collect lessons from supplier reviews and incidents and propose changes to the risk executive function.

Evidence: the approved strategy with its version history and distribution record in the document management system, the system-level plans in the GRC system, the acquisition reviews, and the records of each strategy review.

PM-30(1) — Suppliers of Critical or Mission-essential Items #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline)

Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.

Procedure:

When a System Owner prepares or updates the system-level supply chain risk management plan, the System Owner lists the critical suppliers for the system. The CISO’s staff combine these lists into the organization-wide supplier list. They rank each supplier by mission impact and High Value Asset support. They then assess the top-ranked suppliers through supplier reviews and supply chain risk assessments. The CISO’s staff record each assessment and any resulting risk in the GRC system.

Evidence: the ranked supplier list, the supplier assessments, and the related risk records in the GRC system.

PM-31 — Continuous Monitoring Strategy #

Baselines: Privacy CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics — to be defined]; b. Establishing [Assignment: organization-defined monitoring frequencies — to be defined] and [Assignment: organization-defined assessment frequencies — to be defined] for control effectiveness; c. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy; d. Correlation and analysis of information generated by control assessments and monitoring; e. Response actions to address results of the analysis of control assessment and monitoring information; and f. Reporting the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles — to be defined] [Assignment: organization-defined frequency — to be defined].

Procedure:

The CISO’s staff publish the continuous monitoring strategy in the document management system. The strategy lists each metric, its data source, its monitoring frequency, and the assessment frequency for each control. The Privacy Officer publishes the privacy continuous monitoring strategy in the same way after the SAOP approves it.

ISSOs and Common Control Providers collect metric data and enter control assessment results in the GRC system. The CISO’s staff compare results across systems to find shared weaknesses, trends, and metrics outside tolerance. When they find a weakness, the System Owner decides with the ISSO whether to fix it or open a POA&M item. The ISSO records the item in the GRC system with an owner and a due date. The CISO’s staff track all items at the program level and flag overdue ones.

The CISO’s staff produce a status report from the GRC system for each system and for the Organization. The Privacy Officer adds privacy status. The CISO and SAOP send the report to the officials named in this policy. Authorizing Officials use it to decide whether each authorization can continue.

Evidence: the published strategies, the metric data and assessment results in the GRC system, the POA&M items with owners and dates, and the status reports with their distribution records.

PM-32 — Purposing #

Baselines: Program management (organization-wide; NIST SP 800-53B sets no baseline) CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Analyze [Assignment: organization-defined systems or system components — to be defined] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.

Procedure:

The System Owner records the system’s intended purpose, the mission essential functions it supports, and its High Value Asset status in the SSPP in the GRC system. The ISSO starts a purpose review at each reauthorization and when a change request proposes a significant change.

The ISSO compares the stated purpose with the system’s current interconnections, installed services and software, user groups, and information types. The ISSO lists every use that falls outside the stated purpose and the added exposure each one creates. The System Owner decides whether to remove each use or ask the Authorizing Official to accept it.

If the System Owner removes a use, the ISSO confirms the removal and records it in the GRC system. If the Authorizing Official accepts a use, the ISSO records the decision as a risk acceptance in the GRC system. The System Owner then updates the SSPP and the risk assessment. The CISO’s staff review High Value Asset results first and report open items to the CISO.

Evidence: the stated purpose in the SSPP, the ISSO’s purpose review, the removal confirmations, the risk acceptances, and the updated SSPP and risk assessment in the GRC system.

4.3 FISMA Reporting and Risk Escalation Steps #

The CISO runs the FISMA reporting cycle on the dates in the current OMB FISMA guidance. The last step covers risks that exceed an Authorizing Official’s authority.

Step 1: Prepare the annual FISMA report #

Meet the annual reporting duty in 44 U.S.C. 3554(c).

Step 2: Submit the quarterly metrics #

Report the CIO metrics OMB collects each quarter.

Step 3: Support the Inspector General evaluation #

Give the Inspector General what it needs for the annual evaluation.

Step 4: Escalate risk above an Authorizing Official #

Send risk that exceeds the risk tolerance to the risk executive function.

Evidence: the data call responses, the CyberScope submissions, the signed agency head letter, the reports to Congress and GAO, and each risk referral and decision.

Source: 44 U.S.C. 3554(c) and 3555; OMB M-25-04, Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 2025), sections IV through IX; NIST SP 800-37 Rev. 2, Appendix D (risk executive function); NIST SP 800-39.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

No organization-defined parameters apply to this control.

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for PM
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric CG.01
• Evidence for IG FISMA metric CG.03
• Evidence for IG FISMA metric CG.04
• Evidence for IG FISMA metric RAM.01
• Evidence for IG FISMA metric RAM.02
• Evidence for IG FISMA metric RAM.03
• Evidence for IG FISMA metric RAM.04

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Executive Order 14306: Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending EO 13694 and EO 14144, June 6, 2025.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, April 3, 2025.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• Capital planning and investment control process of each executive agency (40 U.S.C. § 11312).
• Executive Order 13719: Establishment of the Federal Privacy Council, February 9, 2016.
• Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026.
• Executive Order 14434: Inaugurating the Era of Super Intelligence, September 29, 2026.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST IR 8286 Rev. 1: Integrating Cybersecurity and Enterprise Risk Management (ERM), December 18, 2025.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-39: Managing Information Security Risk: Organization, Mission, and Information System View, March 2011.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-11: Preparation, Submission, and Execution of the Budget, August 29, 2025.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.
• OMB M-19-23: Phase 1 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Learning Agendas, Personnel, and Planning Guidance, July 10, 2019.
• OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020.
• OMB M-25-05: Phase 2 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Open Government Data Access and Management Guidance, January 15, 2025.
• OMB M-26-10: Reinforcing Transparency, Accountability, and Oversight of Federal Technology, March 31, 2026.
• Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council (Pub. L. 115-390, Title II; 41 U.S.C. §§ 1321–1328; 41 U.S.C. § 4713), December 21, 2018.