PM-29 Risk Management Program Leadership Roles

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Related controls: PM-2, PM-19

Control statement

• a. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
• b. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.

NIST discussion

The senior accountable official for risk management leads the risk executive (function) in organization-wide risk management activities.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-29

Determine if:

• PM-29a.
  • PM-29a.[01] a Senior Accountable Official for Risk Management is appointed;
  • PM-29a.[02] a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes;
• PM-29b.
  • PM-29b.[01] a Risk Executive (function) is established;
  • PM-29b.[02] a Risk Executive (function) views and analyzes risk from an organization-wide perspective;
  • PM-29b.[03] a Risk Executive (function) ensures that the management of risk is consistent across the organization.

Examine: Information security program plan; privacy program plan; risk management strategy; supply chain risk management strategy; documentation of appointment, roles, and responsibilities of a Senior Accountable Official for Risk Management; documentation of actions taken by the Official; documentation of the establishment, policies, and procedures of a Risk Executive (function).

Interview: Senior Accountable Official for Risk Management; chief information officer; senior agency information security officer; senior agency official for privacy; organizational personnel with information security and privacy program responsibilities.

Policy statement

• The Senior leader shall appoint a senior accountable official for risk management to align the organization’s information security and privacy management processes with its strategic, operational and budgetary planning. (PM-29a)
• The Senior leader shall establish a risk executive function to view and analyze risk from an organization-wide perspective and keep risk management consistent across the organization. (PM-29b)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-29 asks for two leadership roles. You appoint a senior accountable official for risk management to align information security and privacy management processes with strategic, operational and budgetary planning (a). You establish a risk executive (function) to view and analyze risk from an organization-wide perspective and keep risk management consistent across the organization (b). PM-29 is in no SP 800-53B baseline. It still applies to any organization that adopts the Program Management policy as written, because the policy has its clause, as PM-7(1) does.

NIST’s PM-29 discussion says the senior accountable official for risk management leads the risk executive (function). SP 800-37 Rev. 2, Appendix D, says that official is the head of the organization or someone the head designates. The official decides the structure and responsibilities of the risk executive (function), and may keep the function or delegate it to another official or group. The risk executive (function) makes sure risk decisions for systems, including authorization decisions, are seen from an organization-wide view, and that managing risk is consistent and reflects the organization’s risk tolerance. SP 800-39, section 2.3.2, says the function can be one person or office with expert staff, or a group such as a risk board, executive steering committee or executive leadership council.

In the RMF, these roles lead task P-7, the organization-wide continuous monitoring strategy (PM-31), and support the risk management strategy (task P-2, PM-9) and the authorization decision (task R-4). They advise; they do not accept risk for a system. Task R-3 says “the authorizing official is the only person who can accept risk.” Where the risk management strategy says a high risk needs the risk executive (function), the authorizing official consults it and still makes the decision.

Common implementations. The Program Management policy has the senior leader appoint the official and establish the function. Record both in the roles table of the Information Security Program Plan (section 3) and in the governance table of the Risk Management Strategy (section 2), which has fields for the function’s members and how often it meets. A charter for the function that would pass an assessment states its chair, members, meeting frequency, the decisions it makes, what it reviews before authorization decisions, and how it resolves differences in risk tolerance between parts of the organization.

PM-29 has no parameters. Typical choices, which your organization may make differently:

Choice	Typical value
Senior accountable official for risk management	The senior leader, or an executive the senior leader designates in writing, such as the chief operating officer or chief risk officer
Form of the risk executive (function)	A risk board chaired by that official, with the chief information officer, the Chief Information Security Officer, the senior privacy official and the leaders of mission and business functions
How often the risk executive (function) meets	Quarterly, and before any authorization decision for which the risk management strategy calls for its consultation
How alignment with planning is shown (a)	Security and privacy priorities in the strategic plan, and the resources for them in budget requests (PM-3)

Evidence assessors ask for.

• The written appointment of the senior accountable official for risk management (a)
• The charter or other document that establishes the risk executive (function), with its members (b)
• Records of meetings and decisions, such as reviews of high risks across systems or resolved differences between units
• Planning and budget documents that show security and privacy needs were considered (a)
• Records of the function’s consultation before authorization decisions, where the strategy calls for it

Inheritance. PM-29 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system’s authorizing official consults these roles as the risk management strategy directs.

Common findings.

• No written appointment; the role is assumed to belong to the chief information officer.
• A risk board named in the strategy that has never met.
• The risk executive (function) or its chair signing risk acceptances in place of the authorizing official.
• No privacy member, so privacy risk is not seen from an organization-wide view.
• Budget and strategic planning that never consider security and privacy risk (a).

Enhancements. PM-29 has no enhancements.

Federal systems (as of October 2026). FISMA has the agency head ensure that information security management processes are integrated with strategic, operational and budgetary planning processes (44 U.S.C. § 3554(a)(1)(C)), the alignment PM-29a gives the senior accountable official. SP 800-37 Rev. 2, Appendix D, says the senior accountable official for risk management and the risk executive (function) are each “an inherent U.S. Government function” assigned to government personnel only. OMB Circular A-130, Appendix I, section 5.c and its footnote 104, describes the risk executive function as an individual or group that helps ensure system risk decisions, including authorizations, are viewed agency-wide and that managing system-related risk is consistent across the agency and reflects its risk tolerance.

Artifacts

• Information Security Program Plan
• Program Management Decision Worksheet
• Program Management Policy
• Risk Management Strategy