Program Management (PM)
The Program Management family has 32 active controls in SP 800-53 release 5.2.0. “Yes” marks membership in the SP 800-53B baselines.
| Control | Title | Low | Moderate | High | Privacy |
|---|---|---|---|---|---|
| PM-1 | Information Security Program Plan | ||||
| PM-2 | Information Security Program Leadership Role | ||||
| PM-3 | Information Security and Privacy Resources | Yes | |||
| PM-4 | Plan of Action and Milestones Process | Yes | |||
| PM-5 | System Inventory | ||||
| PM-6 | Measures of Performance | Yes | |||
| PM-7 | Enterprise Architecture | Yes | |||
| PM-8 | Critical Infrastructure Plan | Yes | |||
| PM-9 | Risk Management Strategy | Yes | |||
| PM-10 | Authorization Process | Yes | |||
| PM-11 | Mission and Business Process Definition | Yes | |||
| PM-12 | Insider Threat Program | ||||
| PM-13 | Security and Privacy Workforce | Yes | |||
| PM-14 | Testing, Training, and Monitoring | Yes | |||
| PM-15 | Security and Privacy Groups and Associations | ||||
| PM-16 | Threat Awareness Program | ||||
| PM-17 | Protecting Controlled Unclassified Information on External Systems | Yes | |||
| PM-18 | Privacy Program Plan | Yes | |||
| PM-19 | Privacy Program Leadership Role | Yes | |||
| PM-20 | Dissemination of Privacy Program Information | Yes | |||
| PM-21 | Accounting of Disclosures | Yes | |||
| PM-22 | Personally Identifiable Information Quality Management | Yes | |||
| PM-23 | Data Governance Body | ||||
| PM-24 | Data Integrity Board | Yes | |||
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | Yes | |||
| PM-26 | Complaint Management | Yes | |||
| PM-27 | Privacy Reporting | Yes | |||
| PM-28 | Risk Framing | Yes | |||
| PM-29 | Risk Management Program Leadership Roles | ||||
| PM-30 | Supply Chain Risk Management Strategy | ||||
| PM-31 | Continuous Monitoring Strategy | Yes | |||
| PM-32 | Purposing |
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.