PM-14 Testing, Training, and Monitoring

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: AT-2, AT-3, CA-7, CP-4, IR-3, PM-12, SI-4

Control statement

• a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:
  • 1. Are developed and maintained; and
  • 2. Continue to be executed; and
• b. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

NIST discussion

A process for organization-wide security and privacy testing, training, and monitoring helps ensure that organizations provide oversight for testing, training, and monitoring activities and that those activities are coordinated. With the growing importance of continuous monitoring programs, the implementation of information security and privacy across the three levels of the risk management hierarchy and the widespread use of common controls, organizations coordinate and consolidate the testing and monitoring activities that are routinely conducted as part of ongoing assessments supporting a variety of controls. Security and privacy training activities, while focused on individual systems and specific roles, require coordination across all organizational elements. Testing, training, and monitoring plans and activities are informed by current threat and vulnerability assessments.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-14

Determine if:

• PM-14a.
  • PM-14a.01
    • PM-14a.01[01] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed;
    • PM-14a.01[02] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained;
    • PM-14a.01[03] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed;
    • PM-14a.01[04] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained;
  • PM-14a.02
    • PM-14a.02[01] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed;
    • PM-14a.02[02] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed;
• PM-14b.
  • PM-14b.[01] testing plans are reviewed for consistency with the organizational risk management strategy;
  • PM-14b.[02] training plans are reviewed for consistency with the organizational risk management strategy;
  • PM-14b.[03] monitoring plans are reviewed for consistency with the organizational risk management strategy;
  • PM-14b.[04] testing plans are reviewed for consistency with organization-wide priorities for risk response actions;
  • PM-14b.[05] training plans are reviewed for consistency with organization-wide priorities for risk response actions;
  • PM-14b.[06] monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.

Examine: Information security program plan; privacy program plan; plans for conducting security and privacy testing, training, and monitoring activities; organizational procedures addressing the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities; risk management strategy; procedures for the review of plans for conducting security and privacy testing, training, and monitoring activities for consistency with risk management strategy and risk response priorities; results of risk assessments associated with conducting security and privacy testing, training, and monitoring activities; documentation of the timely execution of plans for conducting security and privacy testing, training, and monitoring activities; other relevant documents or records.

Interview: Organizational personnel with responsibilities for developing and maintaining plans for conducting security and privacy testing, training, and monitoring activities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities; mechanisms supporting the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities.

Policy statement

• The Chief Information Security Officer shall maintain a process that ensures the organization’s plans for security and privacy testing, training and monitoring of organizational systems are developed and maintained. (PM-14a.1)
• The Chief Information Security Officer shall track that those plans continue to be carried out. (PM-14a.2)
• The Chief Information Security Officer shall review the testing, training and monitoring plans for consistency with the risk management strategy and the organization-wide priorities for risk response. (PM-14b)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-14 is the organization-level oversight of security and privacy testing, training and monitoring. You keep a process that makes sure the plans for each activity are developed and maintained (a.1) and continue to be carried out (a.2). You also review the plans against the risk management strategy and the organization’s priorities for risk response (b). PM-14 is in the SP 800-53B Privacy baseline.

NIST’s PM-14 discussion says the process lets the organization oversee and coordinate these activities. It consolidates the testing and monitoring done in ongoing assessments of many controls, and coordinates training across the organization. It also says the plans and activities are informed by current threat and vulnerability assessments. The individual activities stay with their own controls; PM-14 checks that the plans exist, are followed and fit the strategy.

Common implementations. The Program Management policy gives this process to the Chief Information Security Officer. A common approach is a single register or calendar of every testing, training and monitoring plan, with its owner, schedule and status. It usually covers:

Activity	Plan	Control
Control assessments	Security and privacy assessment plan	CA-2
Continuous monitoring	Continuous Monitoring Strategy	CA-7, PM-31
Contingency plan tests	Contingency plan test plan	CP-4
Incident response tests	Section 10 of the Incident Response Plan	IR-3
Awareness and role-based training	Security and Privacy Training Plan, which serves as the training plan under PM-14	AT-2, AT-3

The Chief Information Security Officer tracks completion against the register and reports gaps to the senior leader with the program’s measures (PM-6). When the risk management strategy or the threat picture changes, the plans are checked again: for example, more frequent testing of the systems that support the highest-priority risks. SP 800-84 describes test, training and exercise programs, and SP 800-137 describes continuous monitoring programs.

Organization-defined parameters. PM-14 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Who keeps the process	The Chief Information Security Officer (the clause)
How often execution is tracked and reported (a.2)	Quarterly, in the program’s report to the senior leader
When the plans are reviewed against the strategy (b)	When each plan is reviewed, and whenever the risk management strategy changes

Evidence assessors ask for.

• The documented process, and the register or calendar of testing, training and monitoring plans
• Each plan, with its owner, schedule and last update (a.1)
• Records showing the activities took place as planned, and how missed ones were followed up (a.2)
• Records of the review of the plans against the risk management strategy and risk response priorities (b)

Inheritance. PM-14 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system still carries out its own assessments, tests and training under the controls in the table.

Common findings.

• No single view of testing, training and monitoring, so missed tests go unnoticed.
• Plans that exist but were not carried out on schedule, with no follow-up (a.2).
• Testing and monitoring schedules that ignore the risk priorities in the strategy (b).
• Privacy testing, training and monitoring left out of the process.

Enhancements. PM-14 has no enhancements.

Federal systems (as of October 2026). FISMA requires each agency’s program to include periodic testing and evaluation of the effectiveness of security policies, procedures and practices, “with a frequency depending on risk, but no less than annually” (44 U.S.C. § 3554(b)(5)). That testing includes management, operational and technical controls of every system in the inventory. Section 3554(b)(4) requires security awareness training for personnel, including contractors. OMB Circular A-130, Appendix I, section 4.c(14), requires control assessments before operation and periodically thereafter, at the frequency in the agency’s continuous monitoring strategies. Section 4.d(5) requires an information security continuous monitoring strategy across the organizational risk management tiers.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy
• Security and Privacy Training Plan