PM-28 Risk Framing

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: CA-7, PM-9, RA-3, RA-7

Control statement

• a. Identify and document:
  • 1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
  • 2. Constraints affecting risk assessments, risk responses, and risk monitoring;
  • 3. Priorities and trade-offs considered by the organization for managing risk; and
  • 4. Organizational risk tolerance;
• b. Distribute the results of risk framing activities to [Assignment: organization-defined personnel] ; and
• c. Review and update risk framing considerations [Assignment: organization-defined frequency].

NIST discussion

Risk framing is most effective when conducted at the organization level and in consultation with stakeholders throughout the organization including mission, business, and system owners. The assumptions, constraints, risk tolerance, priorities, and trade-offs identified as part of the risk framing process inform the risk management strategy, which in turn informs the conduct of risk assessment, risk response, and risk monitoring activities. Risk framing results are shared with organizational personnel, including mission and business owners, information owners or stewards, system owners, authorizing officials, senior agency information security officer, senior agency official for privacy, and senior accountable official for risk management.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-28

Determine if:

• PM-28a.
  • PM-28a.01
    • PM-28a.01[01] assumptions affecting risk assessments are identified and documented;
    • PM-28a.01[02] assumptions affecting risk responses are identified and documented;
    • PM-28a.01[03] assumptions affecting risk monitoring are identified and documented;
  • PM-28a.02
    • PM-28a.02[01] constraints affecting risk assessments are identified and documented;
    • PM-28a.02[02] constraints affecting risk responses are identified and documented;
    • PM-28a.02[03] constraints affecting risk monitoring are identified and documented;
  • PM-28a.03
    • PM-28a.03[01] priorities considered by the organization for managing risk are identified and documented;
    • PM-28a.03[02] trade-offs considered by the organization for managing risk are identified and documented;
  • PM-28a.04 organizational risk tolerance is identified and documented;
• PM-28b. the results of risk framing activities are distributed to [Assignment: organization-defined personnel];
• PM-28c. risk framing considerations are reviewed and updated [Assignment: organization-defined frequency].

Examine: Information security program plan; privacy program plan; supply chain risk management strategy; documentation of risk framing activities; policies and procedures for risk framing activities; risk management strategy.

Interview: Organizational personnel (including mission, business, and system owners or stewards; authorizing officials; senior agency information security officer; senior agency official for privacy; and senior accountable official for risk management).

Test: Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing; organizational processes for risk framing; mechanisms supporting the development, review, update, and approval of risk framing.

Policy statement

• The Chief Information Security Officer shall identify and document the assumptions affecting risk assessment, risk response and risk monitoring. (PM-28a.1)
• The Chief Information Security Officer shall identify and document the constraints affecting risk assessment, risk response and risk monitoring. (PM-28a.2)
• The Chief Information Security Officer shall identify and document the priorities and trade-offs the organization considers in managing risk. (PM-28a.3)
• The Senior leader shall set and document the organization’s risk tolerance. (PM-28a.4)
• The Chief Information Security Officer shall distribute the results of risk framing to Fill in: the personnel to receive the results of risk framing activities Typical: authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management. (PM-28b)
• The Chief Information Security Officer shall review and update the risk framing Fill in: the frequency for reviewing and updating risk framing considerations Typical: annually, with the risk management strategy. (PM-28c)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-28 asks you to identify and document the context for risk decisions: the assumptions (a.1) and constraints (a.2) that affect risk assessment, response and monitoring, the priorities and trade-offs you consider (a.3), and your risk tolerance (a.4). You distribute the results to set personnel (b) and review and update them at a set frequency (c). PM-28 is in the SP 800-53B Privacy baseline.

NIST’s PM-28 discussion says risk framing works best at the organization level, in consultation with mission, business and system owners. The assumptions, constraints, risk tolerance, priorities and trade-offs inform the risk management strategy (PM-9), which in turn informs risk assessment, response and monitoring. The results go to mission and business owners, information owners or stewards, system owners, authorizing officials, the senior agency information security officer, the senior agency official for privacy and the senior accountable official for risk management.

SP 800-39, section 3.1, says risk framing “produces a risk management strategy”. Its tasks 1-1 to 1-4 match PM-28a: assumptions, constraints, risk tolerance, and priorities and trade-offs. Task 1-3 says the residual risk that authorizing officials accept is “within the organizational risk tolerance, and not the individual risk tolerances of those authorizing officials”. That is why distribution (b) matters. SP 800-161 Rev. 1 adds that supply chain risk should be part of risk framing.

Only the authorizing official accepts risk for an authorized system. SP 800-37 Rev. 2 task R-3 says “the authorizing official is the only person who can accept risk.” Risk framing sets the tolerance the authorizing official applies and names who to consult at each risk level; it does not move the acceptance to anyone else.

Common implementations. Section 3 of the Risk Management Strategy is the risk framing: assumptions (3.1), constraints (3.2), risk tolerance (3.3), priorities and trade-offs (3.4) and distribution (3.5). Its section 8 holds the review. The Program Management policy has the Chief Information Security Officer document the framing and the senior leader set the risk tolerance, which matches SP 800-37 Rev. 2 task P-2, where the head of the organization is primarily responsible for the strategy and its risk tolerance.

Write the framing so others can use it:

• Assumptions name threat sources, the vulnerabilities and conditions that matter, the consequences that matter most, and how likelihood is judged, including privacy risk to individuals.
• Constraints name the real limits: budget, law and contracts, legacy technology, staffing and suppliers.
• Risk tolerance is stated per risk level, with the roles the authorizing official consults, so an assessed risk maps straight to a decision.
• Priorities and trade-offs say which missions come first and which trade-offs are acceptable, such as degraded service for a short time in exchange for a faster fix.

Organization-defined parameters. From templates/policy/pm/. Typical values, which your organization may set differently:

Parameter	Typical value
Personnel who receive the results of risk framing (b)	Authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management
Review and update frequency (c)	Annually, with the risk management strategy

The list follows the roles NIST’s discussion names. The Chief Information Security Officer, who holds the senior agency information security officer’s role, distributes the results and so is not listed.

Evidence assessors ask for.

• The approved risk framing, usually section 3 of the risk management strategy, covering each element a.1 to a.4
• The senior leader’s approval of the risk tolerance (a.4)
• Distribution records, such as a dated notice to the roles in the parameter (b)
• The record of the last review and update (c)
• A sample of system risk assessments that use the framing’s assumptions, and of authorization decisions that refer to its tolerance

SP 800-53A has assessors interview mission, business and system owners, authorizing officials, the senior agency information security officer, the senior agency official for privacy and the senior accountable official for risk management, so each should know where the framing is and what it says.

Inheritance. PM-28 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system’s risk assessment (RA-3) and risk response (RA-7) start from it.

Common findings.

• Generic framing, such as “we take threats seriously”, that no risk assessment can use.
• A risk tolerance of one word, such as “low”, that no authorizing official can apply.
• Framing never sent to authorizing officials, who then each apply their own tolerance (b).
• No privacy assumptions or privacy risk tolerance.
• Framing not updated after a change in mission, threat or law (c).
• Risk acceptance given to someone other than the authorizing official.

Enhancements. PM-28 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix I, section 3.a, has agencies “implement an agency-wide risk management process that frames, assesses, responds to, and monitors information security and privacy risk”. Section 5.b, in the discussion of major provisions, names the four elements of PM-28a: “Establishing a realistic and credible risk management strategy requires that agencies identify their risk assumptions, risk constraints, risk tolerance, and priorities and trade-offs.”

Artifacts

• Program Management Decision Worksheet
• Program Management Policy
• Risk Management Strategy