PM-13 Security and Privacy Workforce

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: AT-2, AT-3

Control statement

Establish a security and privacy workforce development and improvement program.

NIST discussion

Security and privacy workforce development and improvement programs include defining the knowledge, skills, and abilities needed to perform security and privacy duties and tasks; developing role-based training programs for individuals assigned security and privacy roles and responsibilities; and providing standards and guidelines for measuring and building individual qualifications for incumbents and applicants for security- and privacy-related positions. Such workforce development and improvement programs can also include security and privacy career paths to encourage security and privacy professionals to advance in the field and fill positions with greater responsibility. The programs encourage organizations to fill security- and privacy-related positions with qualified personnel. Security and privacy workforce development and improvement programs are complementary to organizational security awareness and training programs and focus on developing and institutionalizing the core security and privacy capabilities of personnel needed to protect organizational operations, assets, and individuals.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-13

Determine if:

• PM-13[01] a security workforce development and improvement program is established;
• PM-13[02] a privacy workforce development and improvement program is established.

Examine: Information security program plan; privacy program plan; information security and privacy workforce development and improvement program documentation; procedures for the information security and privacy workforce development and improvement program; information security and privacy role-based training program documentation; other relevant documents or records.

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for the information security and privacy workforce development and improvement program; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for implementing the information security and privacy workforce development and improvement program; mechanisms supporting and/or implementing the information security and privacy workforce development and improvement program.

Policy statement

• The Chief Information Security Officer and the Senior privacy official shall establish a security and privacy workforce development and improvement program. (PM-13)
• The program shall define the knowledge and skills each security and privacy role needs, and the training and development that build them. (PM-13)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-13 asks for a program that develops and improves the security and privacy workforce. NIST’s PM-13 discussion says such a program defines the knowledge, skills and abilities that security and privacy duties need. It also builds role-based training for people in those roles, and sets standards for measuring and building the qualifications of incumbents and applicants. It can add career paths to keep people in the field. PM-13 is in the SP 800-53B Privacy baseline.

The discussion says the program complements awareness and training (AT-2, AT-3); it focuses on building the core capabilities of the people who protect the organization. SP 800-181 Rev. 1, the NICE Framework, gives a common language for the work: Task, Knowledge and Skill statements, grouped into work roles and competencies. NIST keeps its current components at the NICE Framework Resource Center. SP 800-50 Rev. 1 (September 2024) describes how to build a cybersecurity and privacy learning program.

Common implementations. The Program Management policy has the Chief Information Security Officer and the senior privacy official establish the program. It defines the knowledge and skills each security and privacy role needs, and the training and development that build them. In practice that means four things:

• A list of the organization’s security and privacy roles, each mapped to NICE Framework work roles, with the knowledge and skills it needs
• Qualification standards for each role, such as experience, training or certifications, used in hiring and in position descriptions
• A development plan for each person in a role, reviewed each year
• Career paths that show how people move into roles with more responsibility

The role-based courses go in section 5 of the Security and Privacy Training Plan, which serves AT-3 and this control. Section 7 of the Information Security Program Plan points to the program.

Organization-defined parameters. PM-13 has none. The choices the PM-13 clause makes, typical values your organization may set differently:

Choice	Typical value
Who establishes the program	The Chief Information Security Officer and the senior privacy official
How the knowledge and skills for each role are defined	Mapped to NICE Framework work roles and their Task, Knowledge and Skill statements
Where the training and development for each role are listed	The training plan’s role-based training section

Evidence assessors ask for.

• The program description, with its owners
• The list of security and privacy roles with the knowledge and skills each needs
• Qualification standards or position descriptions for a sample of roles
• Development plans and training records for a sample of people in those roles
• Records showing the program is reviewed and improved, such as a skills gap analysis and the actions taken

Inheritance. PM-13 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. System owners identify the security and privacy roles their systems need.

Common findings.

• Role-based training treated as the whole program, with no defined skills, qualifications or development plans.
• Privacy roles left out, with only security roles defined.
• Position descriptions that do not match the skills the program defines.
• No skills gap analysis, so hiring and training priorities are guesses.

Enhancements. PM-13 has no enhancements.

Federal systems (as of October 2026). FISMA has the Chief Information Officer train and oversee personnel with significant information security responsibilities (44 U.S.C. § 3554(a)(3)(D)). It also has the agency head ensure the agency “has trained personnel sufficient to assist the agency in complying” with FISMA (§ 3554(a)(4)). OMB Circular A-130, main body section 5.c(1), requires the Chief Human Capital Officer, the Chief Information Officer, the Chief Acquisition Officer and the Senior Agency Official for Privacy to develop competency requirements for information resources staff, including information security and privacy positions. It also requires them to keep a current workforce planning process. Section 5.c(6) involves the Senior Agency Official for Privacy in the agency’s privacy hiring, training and professional development needs. OPM’s 5 CFR 930.301 requires role-specific training for employees with significant information security responsibilities.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy
• Security and Privacy Training Plan