PM-11 Mission and Business Process Definition

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: CP-2, PL-2, PM-7, PM-8, RA-2, RA-3, RA-9, SA-2

Control statement

• a. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
• b. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
• c. Review and revise the mission and business processes [Assignment: organization-defined frequency].

NIST discussion

Protection needs are technology-independent capabilities that are required to counter threats to organizations, individuals, systems, and the Nation through the compromise of information (i.e., loss of confidentiality, integrity, availability, or privacy). Information protection and personally identifiable information processing needs are derived from the mission and business needs defined by organizational stakeholders, the mission and business processes designed to meet those needs, and the organizational risk management strategy. Information protection and personally identifiable information processing needs determine the required controls for the organization and the systems. Inherent to defining protection and personally identifiable information processing needs is an understanding of the adverse impact that could result if a compromise or breach of information occurs. The categorization process is used to make such potential impact determinations. Privacy risks to individuals can arise from the compromise of personally identifiable information, but they can also arise as unintended consequences or a byproduct of the processing of personally identifiable information at any stage of the information life cycle. Privacy risk assessments are used to prioritize the risks that are created for individuals from system processing of personally identifiable information. These risk assessments enable the selection of the required privacy controls for the organization and systems. Mission and business process definitions and the associated protection requirements are documented in accordance with organizational policies and procedures.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-11

Determine if:

• PM-11a.
  • PM-11a.[01] organizational mission and business processes are defined with consideration for information security;
  • PM-11a.[02] organizational mission and business processes are defined with consideration for privacy;
  • PM-11a.[03] organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
• PM-11b.
  • PM-11b.[01] information protection needs arising from the defined mission and business processes are determined;
  • PM-11b.[02] personally identifiable information processing needs arising from the defined mission and business processes are determined;
• PM-11c. the mission and business processes are reviewed and revised [Assignment: organization-defined frequency].

Examine: Information security program plan; privacy program plan; risk management strategy; procedures for determining mission and business protection needs; information security and privacy risk assessment results relevant to the determination of mission and business protection needs; personally identifiable information processing policy; personally identifiable information inventory; other relevant documents or records.

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for enterprise risk management; organizational personnel responsible for determining information protection needs for mission and business processes; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for defining mission and business processes and their information protection needs.

Policy statement

• The Senior leader shall ensure the organization’s mission and business processes are defined with consideration for information security, privacy and the resulting risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-11a)
• The Chief Information Security Officer and the Senior privacy official shall determine the information protection and personally identifiable information processing needs that arise from those processes. (PM-11b)
• The Senior leader shall review and revise the mission and business processes Fill in: the frequency at which to review and revise the mission and business processes Typical: annually, and whenever the organization changes its mission, structure or major services. (PM-11c)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-11 asks you to define the organization’s mission and business processes with security, privacy and the resulting risk in mind (a). From them you determine what protection the information needs and how personally identifiable information must be processed (b). You review and revise the processes at a set frequency (c). PM-11 is in the SP 800-53B Privacy baseline.

NIST’s PM-11 discussion says protection needs are technology-independent capabilities, derived from the mission and business needs, the processes that meet them, and the risk management strategy. Those needs determine the controls the organization and its systems require. The impact of a compromise is found through categorization (RA-2), and privacy risk assessments rank the risks that processing creates for individuals. PM-11 works at the organization level; SP 800-37 Rev. 2 task P-8 then has each system identify the processes it supports.

Common implementations. A list or model of the organization’s mission and business processes, often kept with the enterprise architecture (PM-7) or the continuity program. For each process it records:

• The owner and the services it delivers
• The information it uses and the systems that support it
• The impact of a loss of confidentiality, integrity or availability
• Whether it processes personally identifiable information, and why

The Program Management policy has the senior leader ensure the processes are defined and reviewed. The Chief Information Security Officer and the senior privacy official determine the protection and processing needs that arise from them.

The definitions then feed the system-level work. The business impact analysis (section 3.1) lists the processes a system supports, and the security categorization worksheet sets the impact of the information types they use. The criticality analysis (RA-9) and the privacy impact assessment draw on them too.

Organization-defined parameters. From templates/policy/pm/. Typical value, which your organization may set differently:

Parameter	Typical value
Mission and business process review frequency (c)	Annually, and whenever the organization changes its mission, structure or major services

Evidence assessors ask for.

• The documented mission and business processes, each with an owner
• The protection needs and personally identifiable information processing needs recorded for each process (b)
• Records of the last review and of revisions after a reorganization or a new service (c)
• A trace from a sample of processes to the categorization and business impact analysis of the systems that support them

Inheritance. PM-11 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system draws its categorization and privacy analysis from these definitions.

Common findings.

• Processes documented only in a continuity plan, with no protection needs stated.
• No record of which processes handle personally identifiable information, or why.
• System categorizations that cannot be traced to any process or its impact.
• Process definitions not revised after a reorganization or a new major service.

Enhancements. PM-11 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix I, section 4.a(2), requires agencies to “categorize information and information systems, in accordance with FIPS Publication 199 and NIST SP 800-60, considering potential adverse security and privacy impacts” to operations, assets, individuals, other organizations and the Nation. Section 5.c, in the discussion of major provisions, says the RMF categorizes each system and its information “based on a mission or business impact analysis”, which is what PM-11’s process definitions supply.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy