PM-32 Purposing
Guidance: draftPolicy clause: draftWhat these mean
pm32ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Not in a baseline | Organization | None |
Related controls: CA-7, PL-2, RA-3, RA-9
Control statement
Section titled “Control statement”Analyze [Assignment: organization-defined systems or system components] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.
NIST discussion
Systems are designed to support a specific mission or business function. However, over time, systems and system components may be used to support services and functions that are outside of the scope of the intended mission or business functions. This can result in exposing information resources to unintended environments and uses that can significantly increase threat exposure. In doing so, the systems are more vulnerable to compromise, which can ultimately impact the services and functions for which they were intended. This is especially impactful for mission-essential services and functions. By analyzing resource use, organizations can identify such potential exposures.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for PM-32
Determine if [Assignment: organization-defined systems or system components] supporting mission-essential services or functions are analyzed to ensure that the information resources are being used in a manner that is consistent with their intended purpose.
Examine: Information security program plan; privacy program plan; list of essential services and functions; organizational analysis of information resources; risk management strategy; other relevant documents or records..
Interview: Organizational personnel with information security, privacy, and supply chain risk management program responsibilities.
Policy statement
- The Chief Information Security Officer shall analyze Fill in: the systems or system components supporting mission-essential services or functions Typical: the systems and components that support mission-essential functions, as the business impact analysis identifies them to ensure their information resources are used consistently with their intended purpose. (PM-32)
From the Program Management Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”PM-32 asks you to analyze set systems or system components that support mission-essential services or functions, to make sure their information resources are used for their intended purpose. PM-32 is in no SP 800-53B baseline. It still applies to any organization that adopts the Program Management policy as written, because the policy has its clause, as PM-7(1) does.
NIST’s PM-32 discussion says systems are designed to support a specific mission or business function, but over time they may be used for services and functions outside that scope. That can expose information resources to unintended environments and uses, increase threat exposure and make the systems more vulnerable, which in turn harms the functions they were built for. The effect is greatest for mission-essential services and functions. Analyzing how resources are used shows these exposures. SP 800-161 Rev. 1 adds that the analysis should include supply chain exposures.
The analysis needs a recorded purpose to compare against. The system security plan (PL-2) states it, the criticality analysis (RA-9) and business impact analysis show which systems support mission-essential functions, and continuous monitoring (CA-7) supplies the evidence of actual use.
Common implementations. The Program Management policy has the Chief Information Security Officer do the analysis. Record each system’s intended purpose where it is first defined: the description column of the system inventory and the purpose row of the security categorization worksheet. The business impact analysis marks the essential processes, which sets the scope.
For each system in scope, compare current use with the recorded purpose. Useful sources are the component inventory (CM-8), approved changes (CM-3), information exchange agreements (CA-3), the accounts and user groups (AC-2) and network flows. Look for:
- New user groups or organizations using the system
- New kinds of data, especially personally identifiable information the categorization did not consider
- Software, services or workloads unrelated to the mission function
- New connections to other systems or the internet
Each finding ends one of two ways: the unintended use is removed, or the organization accepts the new purpose formally, updating the categorization, the plans and the authorization. Track open findings in the plan of action and milestones.
Organization-defined parameters. From templates/policy/pm/. Typical value, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| Systems or components to analyze | The systems and components that support mission-essential functions, as the business impact analysis identifies them |
The clause sets no frequency. A typical choice is annually, with the system’s yearly assessment, and whenever a significant change is proposed.
Evidence assessors ask for.
- The list of systems and components in scope, traced to the business impact analysis or criticality analysis
- The recorded intended purpose of each
- The analysis records, with the sources used and the date
- Actions on findings: uses removed, or new purposes approved with updated categorization and authorization
Inheritance. PM-32 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system owner supplies the information the analysis needs.
Common findings.
- No recorded purpose to compare against, beyond the system’s name.
- A mission system also used as a file share, test bed or general server.
- New functions added through change control with no review of whether they fit the system’s purpose.
- The analysis done once, at authorization, and never repeated.
Enhancements. PM-32 has no enhancements.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.