PM-23 Data Governance Body

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Related controls: AT-2, AT-3, PM-19, PM-22, PM-24, PT-7, SI-4, SI-19

Control statement

Establish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].

NIST discussion

A Data Governance Body can help ensure that the organization has coherent policies and the ability to balance the utility of data with security and privacy requirements. The Data Governance Body establishes policies, procedures, and standards that facilitate data governance so that data, including personally identifiable information, is effectively managed and maintained in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidance. Responsibilities can include developing and implementing guidelines that support data modeling, quality, integrity, and the de-identification needs of personally identifiable information across the information life cycle as well as reviewing and approving applications to release data outside of the organization, archiving the applications and the released data, and performing post-release monitoring to ensure that the assumptions made as part of the data release continue to be valid. Members include the chief information officer, senior agency information security officer, and senior agency official for privacy. Federal agencies are required to establish a Data Governance Body with specific roles and responsibilities in accordance with the EVIDACT and policies set forth under OMB M-19-23.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-23

Determine if a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities] is established.

Examine: Privacy program plan; documentation relating to the Data Governance Body, including documents establishing such a body, its charter of operations, and any plans and reports; records of board meetings and decisions; records of requests to review data; policies, procedures, and standards that facilitate data governance.

Interview: Officials serving on the Data Governance Body (e.g., chief information officer, senior agency information security officer, and senior agency official for privacy).

Policy statement

• The Senior leader shall establish a data governance body made up of Fill in: the roles of a Data Governance Body Typical: the chief data officer (chair), the chief information officer, the chief information security officer, the senior privacy official, the records manager and the owners of major data sets, with responsibility for Fill in: the responsibilities of a Data Governance Body Typical: setting data governance policy, approving data sharing agreements, and resolving data quality and access issues. (PM-23)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-23 asks you to establish a data governance body, with members and responsibilities you define. PM-23 is in no SP 800-53B baseline, including the Privacy baseline. It still applies to any organization that adopts the Program Management policy as written, because the policy has its clause, as PM-7(1) does.

NIST’s PM-23 discussion says the body helps the organization keep coherent policies and balance the usefulness of data against security and privacy requirements. It sets policies, procedures and standards so that data, including personally identifiable information, is managed lawfully. Its work can include guidelines for data modeling, quality, integrity and de-identification across the life cycle. It can also review and approve releases of data outside the organization, archive the applications and released data, and monitor releases afterwards.

The discussion names the chief information officer, the senior agency information security officer and the senior agency official for privacy as members. The body’s policies set the frame for personally identifiable information quality (PM-22) and de-identification (SI-19).

Common implementations. The Program Management policy has the senior leader establish the body. A charter that would pass an assessment states:

• The chair, the members by role, and a quorum
• The decisions the body makes, and what it only advises on
• How often it meets, and how it records decisions
• How requests reach it, such as a data sharing request or a data quality issue
• How it reports to the senior leader

A small organization can give these duties to an existing governance committee, if its charter adds them and the members include the roles below. Record the body in the program plan’s roles table in the Information Security Program Plan.

Organization-defined parameters. From templates/policy/pm/. Typical values, which your organization may set differently:

Parameter	Typical value
Roles on the data governance body	The chief data officer (chair), the chief information officer, the chief information security officer, the senior privacy official, the records manager and the owners of major data sets
Responsibilities of the data governance body	Setting data governance policy, approving data sharing agreements, and resolving data quality and access issues

The list includes the chief information officer because NIST’s discussion names that role as a member, with the senior agency information security officer and the senior agency official for privacy. In a small organization one person may hold several of these roles; the charter still names each role.

Evidence assessors ask for.

• The charter or other document that establishes the body, with its members and responsibilities
• Meeting records and decisions
• Records of data sharing or release requests the body reviewed, and their outcomes
• The data governance policies, procedures and standards the body issued

Inheritance. PM-23 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system follows the body’s data policies and brings data sharing requests to it.

Common findings.

• A body named in a charter that has never met.
• Members who send delegates with no authority to decide.
• No privacy or security member, so data sharing is approved without them.
• Data released outside the organization without the body’s review.

Enhancements. PM-23 has no enhancements.

Federal systems (as of October 2026). NIST’s discussion says federal agencies must establish a data governance body under the Foundations for Evidence-Based Policymaking Act of 2018 and OMB M-19-23 (July 10, 2019). Section II(a) of M-19-23 required each agency head to establish a Data Governance Body “to be chaired by the Chief Data Officer”. Appendix C says agencies should at least include the Chief Data Officer, Evaluation Officer and Statistical Official and senior program officials. OMB expects roles for others, among them the CIO, CISO, General Counsel and SAOP, who may be members. OMB M-25-05 (January 15, 2025) has Chief Data Officers implement it in coordination with the body “established under OMB M-19-23”. 44 U.S.C. § 3520 requires each agency head to designate a Chief Data Officer, responsible for lifecycle data management.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy