PM-15 Security and Privacy Groups and Associations

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Related controls: SA-11, SI-5

Control statement

Establish and institutionalize contact with selected groups and associations within the security and privacy communities:

• a. To facilitate ongoing security and privacy education and training for organizational personnel;
• b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and
• c. To share current security and privacy information, including threats, vulnerabilities, and incidents.

NIST discussion

Ongoing contact with security and privacy groups and associations is important in an environment of rapidly changing technologies and threats. Groups and associations include special interest groups, professional associations, forums, news groups, users’ groups, and peer groups of security and privacy professionals in similar organizations. Organizations select security and privacy groups and associations based on mission and business functions. Organizations share threat, vulnerability, and incident information as well as contextual insights, compliance techniques, and privacy problems consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-15

Determine if:

• PM-15a.
  • PM-15a.[01] contact is established and institutionalized with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel;
  • PM-15a.[02] contact is established and institutionalized with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel;
• PM-15b.
  • PM-15b.[01] contact is established and institutionalized with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies;
  • PM-15b.[02] contact is established and institutionalized with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies;
• PM-15c.
  • PM-15c.[01] contact is established and institutionalized with selected groups and associations within the security community to share current security information, including threats, vulnerabilities, and incidents;
  • PM-15c.[02] contact is established and institutionalized with selected groups and associations within the privacy community to share current privacy information, including threats, vulnerabilities, and incidents.

Examine: Information security program plan; privacy program plan; risk management strategy; procedures for establishing and institutionalizing contacts with security and privacy groups and associations; lists or other records of contacts with and/or membership in security and privacy groups and associations; other relevant documents or records.

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for establishing and institutionalizing contact with security and privacy groups and associations; organizational personnel with information security and privacy responsibilities; personnel from selected groups and associations with which the organization has established and institutionalized contact.

Test: Organizational processes for establishing and institutionalizing contact with security and privacy groups and associations; mechanisms supporting contact with security and privacy groups and associations.

Policy statement

• The Chief Information Security Officer shall establish and maintain contact with selected security and privacy groups and associations, and record which ones. (PM-15)
• The organization shall use those contacts to support ongoing security and privacy education and training for its personnel. (PM-15a)
• The organization shall use those contacts to stay current with recommended security and privacy practices, techniques and technologies. (PM-15b)
• The organization shall use those contacts to share current security and privacy information, including threats, vulnerabilities and incidents. (PM-15c)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-15 asks you to establish and institutionalize contact with selected groups and associations in the security and privacy communities. The contacts serve three purposes: ongoing education and training for your people (a), keeping current with recommended practices and technologies (b), and sharing current information on threats, vulnerabilities and incidents (c). “Institutionalize” means the contacts belong to the organization, not to whichever employee happens to attend.

PM-15 is in no SP 800-53B baseline, but the PM policy includes its clause, so it applies. NIST’s PM-15 discussion lists the kinds of groups: special interest groups, professional associations, forums, news groups, users’ groups, and peer groups of professionals in similar organizations. You select them based on your mission and business functions. Sharing is consistent with applicable laws, directives, policies, regulations, standards and guidelines.

Common implementations. The Program Management policy has the Chief Information Security Officer establish and maintain the contacts and record which ones. A short register is enough. For each group it lists the purpose (a, b or c), the membership, the organization’s point of contact and a backup, and any sharing agreement. Section 7 of the Information Security Program Plan points to it.

Typical choices include:

• An information sharing and analysis center (ISAC) or organization (ISAO) for your sector, for threat and incident information
• Professional associations for security and privacy staff, for training and certification
• User groups for the main products you run, for practices and vulnerability news
• A peer group of security and privacy officials in similar organizations

Set rules for what may be shared before you share. SP 800-150, section 3.4, says to list the types of information that may be shared, when, and with whom. The rules also cover redaction, source attribution and handling designations, with input from legal and privacy officials. Section 7 of the Incident Response Plan records who incident information goes to, and who approves it. Threat information received this way feeds the threat awareness program (PM-16) and security alerts and advisories (SI-5).

Organization-defined parameters. PM-15 has none. The choices the PM-15 clause and the program plan leave open, typical values your organization may set differently:

Choice	Typical value
Who establishes and maintains the contacts	The Chief Information Security Officer (the clause)
Which groups and associations	A sector ISAC or ISAO, professional associations for security and privacy staff, product user groups, and a peer group of similar organizations
Where they are recorded	A register referenced from the program plan (section 7)

Evidence assessors ask for.

• The register of groups and associations, with points of contact and the purpose of each
• Current memberships, and any sharing agreements
• Records of participation, such as meeting attendance, training taken or advisories received
• Examples of information received that led to action, and of information shared under the sharing rules

Inheritance. PM-15 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls.

Common findings.

• Memberships held by individuals that lapse when they leave, with no record of the contacts.
• No privacy groups, only security ones.
• Information received from sharing groups that never reaches the people who could act on it.
• Incident details shared outside the organization with no rules or approval.

Enhancements. PM-15 has no enhancements.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy