# Program Management Policy

**Template version:** 1.0.0 · **Baseline:** Organization · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/pm/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy establishes [Organization name]'s organization-wide information security program, and states who leads it and how it is planned, resourced and overseen.

## Scope

This policy applies to all of [Organization name]: every system it owns or operates or that is operated on its behalf, the mission and business processes those systems support, and every person with access to them. The program management controls in this policy are carried out once for the organization, and systems inherit them as common controls.

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and for the information security program, and shall approve exceptions to this policy. (PM-1a.2)
- The [Senior privacy official] shall lead the privacy program and coordinate it with the information security program. (PM-1a.3)
- Each [System owner] shall use the common controls the program provides and record them as inherited in the system security plan. (PM-1a.1)
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (PM-1a.2)

## Management commitment

The [Senior leader] approves this policy and shall provide the resources the information security and privacy programs need. (PM-1a.2)

## Coordination

The [Chief Information Security Officer] shall coordinate the program with the privacy, legal, human resources, procurement, finance, physical security and mission functions, and record that coordination in the program plan. (PM-1a.3)

## Compliance

- This policy and the program plan shall be consistent with the laws, regulations and standards that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (PM-1a.2)
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (PM-1a.2)
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (PM-1a.2)
- Violations of this policy shall be handled through the organization's sanctions process. (PM-1a.2)

## Information security program plan

- The [Chief Information Security Officer] shall develop, maintain and disseminate an organization-wide information security program plan. (PM-1a)
- The plan shall give an overview of the requirements for the security program, and describe the program management controls and common controls in place or planned to meet them. (PM-1a.1)
- The plan shall identify and assign roles and responsibilities, and describe management commitment, coordination among organizational entities, and compliance. (PM-1a.2)
- The plan shall reflect the coordination among the organizational entities responsible for information security. (PM-1a.3)
- The [Senior leader], as the senior official accountable for the risk the organization incurs, shall approve the plan. (PM-1a.4)
- The [Chief Information Security Officer] shall disseminate the approved plan to every system owner and authorizing official and to the leaders of the functions named under Coordination. (PM-1a)
- The [Chief Information Security Officer] shall review and update the plan [Fill in: the frequency at which to review and update the organization-wide information security program plan. Typical: annually] and following [Fill in: events that trigger the review and update of the organization-wide information security program plan. Typical: a significant change to the organization's mission, structure, risk tolerance or systems, a major incident, or a finding from an assessment or audit of the program]. (PM-1b)
- The [Chief Information Security Officer] shall protect the plan from unauthorized disclosure and modification by limiting who can change it and keeping each approved version. (PM-1c)

## Policy statements

### Information security program leadership role (PM-2)

- The [Senior leader] shall appoint a [Chief Information Security Officer] to coordinate, develop, implement and maintain the organization-wide information security program. (PM-2)
- The [Senior leader] shall record the appointment in writing and give the [Chief Information Security Officer] the mission and resources the role needs. (PM-2)

#### Federal systems

FISMA requires the agency head to delegate to the Chief Information Officer the authority to ensure compliance, including designating a senior agency information security officer who has information security duties as that official's primary duty and heads an office with the mission and resources to assist in ensuring compliance ([44 U.S.C. § 3554(a)(3)(A)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)).

- The [Chief Information Security Officer] shall be the senior agency information security officer designated under 44 U.S.C. § 3554(a)(3)(A), with information security duties as that official's primary duty. (PM-2)

### Information security and privacy resources (PM-3)

- The [Chief Information Security Officer] and the [Senior privacy official] shall identify the resources the information security and privacy programs need, for each capital planning and investment request. (PM-3a)
- The [Senior leader] shall include those resources in capital planning and investment requests, and document every exception. (PM-3a)
- The [Chief Information Security Officer] and the [Senior privacy official] shall prepare the security and privacy documentation that capital planning and investment requests require under applicable laws, regulations, policies and standards. (PM-3b)
- The [Senior leader] shall make the planned information security and privacy resources available for expenditure. (PM-3c)

### Plan of action and milestones process (PM-4)

- The [Chief Information Security Officer] shall maintain a process that ensures plans of action and milestones are developed and maintained for the information security, privacy and supply chain risk management programs and for each organizational system. (PM-4a.1)
- Each plan of action and milestones shall document the remedial actions planned to respond to risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-4a.2)
- The [Chief Information Security Officer] shall report plans of action and milestones to the [Senior leader] [Fill in: how often, for example quarterly], and to regulators and customers as laws and contracts require. (PM-4a.3)
- The [Chief Information Security Officer] shall review plans of action and milestones for consistency with the risk management strategy and the organization-wide priorities for risk response. (PM-4b)

### System inventory (PM-5)

- The [Chief Information Security Officer] shall maintain an inventory of organizational systems and update it [Fill in: the frequency at which to update the inventory of organizational systems. Typical: quarterly, and whenever a system is authorized, significantly changed or retired]. (PM-5)
- Each [System owner] shall add a system to the inventory before it is authorized or placed in operation. (PM-5)

#### Federal systems

The Paperwork Reduction Act requires each agency head to maintain an inventory of major information systems, updated at least annually ([44 U.S.C. § 3505(c)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3505&num=0&edition=prelim)).

- The [Chief Information Security Officer] shall update the inventory at least annually and whenever the agency adds, significantly changes or retires a major information system. (PM-5)

### Inventory of personally identifiable information (PM-5(1))

- The [Senior privacy official] shall establish, maintain and update [Fill in: the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information. Typical: at least annually, and whenever a privacy impact assessment is completed or updated] an inventory of all systems, applications and projects that process personally identifiable information. (PM-5(1))

### Measures of performance (PM-6)

- The [Chief Information Security Officer] shall develop, monitor and report on measures of performance for the information security program. (PM-6)
- The [Senior privacy official] shall develop, monitor and report on measures of performance for the privacy program. (PM-6)
- The [Chief Information Security Officer] and the [Senior privacy official] shall report the results to the [Senior leader]. (PM-6)

### Enterprise architecture (PM-7)

- The [Chief Information Security Officer] shall ensure the enterprise architecture is developed and maintained with consideration for information security, privacy and the resulting risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-7)
- The [Senior privacy official] shall review changes to the enterprise architecture that affect the processing of personally identifiable information. (PM-7)

### Offloading (PM-7(1))

- Each [System owner] shall offload [Fill in: non-essential functions or services to be offloaded. Typical: non-essential services, such as email, file sharing and public web hosting, on systems that support mission-essential functions] to other systems, system components or an external provider. (PM-7(1))

### Critical infrastructure plan (PM-8)

- The [Chief Information Security Officer] and the [Senior privacy official] shall address information security and privacy issues when the organization develops, documents and updates its critical infrastructure and key resources protection plan. (PM-8)

### Risk management strategy (PM-9)

- The [Chief Information Security Officer] shall develop an organization-wide risk management strategy for security risk to organizational operations and assets, individuals, other organizations and the Nation from the operation and use of organizational systems. (PM-9a.1)
- The strategy shall also address privacy risk to individuals from the authorized processing of personally identifiable information, developed with the [Senior privacy official]. (PM-9a.2)
- The [Senior leader] shall approve the strategy. (PM-9a)
- The [Chief Information Security Officer] shall implement the strategy consistently across the organization. (PM-9b)
- The [Chief Information Security Officer] shall review and update the strategy [Fill in: the frequency at which to review and update the risk management strategy. Typical: annually], and whenever organizational changes require it. (PM-9c)

### Authorization process (PM-10)

- The [Chief Information Security Officer] shall manage the security and privacy state of organizational systems, and the environments they operate in, through an authorization process. (PM-10a)
- The [Senior leader] shall designate the individuals who fill the roles in the risk management process, including an authorizing official for each system. (PM-10b)
- The [Chief Information Security Officer] shall integrate the authorization process into the organization-wide risk management program. (PM-10c)

### Mission and business process definition (PM-11)

- The [Senior leader] shall ensure the organization's mission and business processes are defined with consideration for information security, privacy and the resulting risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-11a)
- The [Chief Information Security Officer] and the [Senior privacy official] shall determine the information protection and personally identifiable information processing needs that arise from those processes. (PM-11b)
- The [Senior leader] shall review and revise the mission and business processes [Fill in: the frequency at which to review and revise the mission and business processes. Typical: annually, and whenever the organization changes its mission, structure or major services]. (PM-11c)

### Insider threat program (PM-12)

- The [Chief Information Security Officer] shall implement an insider threat program. (PM-12)
- The program shall include a cross-discipline insider threat incident handling team, with members from at least security, human resources, legal and privacy. (PM-12)

#### Federal systems

[Executive Order 13587](https://www.federalregister.gov/documents/2011/10/13/2011-26729/structural-reforms-to-improve-the-security-of-classified-networks-and-the-responsible-sharing-and) (October 7, 2011), section 2.1(b), requires the heads of agencies that operate or access classified computer networks to "implement an insider threat detection and prevention program consistent with guidance and standards developed by the Insider Threat Task Force" that section 6 establishes.

- If the agency operates or accesses classified computer networks, the insider threat program shall meet Executive Order 13587, section 2.1(b), and the guidance and standards of the Insider Threat Task Force. (PM-12)

### Security and privacy workforce (PM-13)

- The [Chief Information Security Officer] and the [Senior privacy official] shall establish a security and privacy workforce development and improvement program. (PM-13)
- The program shall define the knowledge and skills each security and privacy role needs, and the training and development that build them. (PM-13)

### Testing, training and monitoring (PM-14)

- The [Chief Information Security Officer] shall maintain a process that ensures the organization's plans for security and privacy testing, training and monitoring of organizational systems are developed and maintained. (PM-14a.1)
- The [Chief Information Security Officer] shall track that those plans continue to be carried out. (PM-14a.2)
- The [Chief Information Security Officer] shall review the testing, training and monitoring plans for consistency with the risk management strategy and the organization-wide priorities for risk response. (PM-14b)

### Security and privacy groups and associations (PM-15)

- The [Chief Information Security Officer] shall establish and maintain contact with selected security and privacy groups and associations, and record which ones. (PM-15)
- The organization shall use those contacts to support ongoing security and privacy education and training for its personnel. (PM-15a)
- The organization shall use those contacts to stay current with recommended security and privacy practices, techniques and technologies. (PM-15b)
- The organization shall use those contacts to share current security and privacy information, including threats, vulnerabilities and incidents. (PM-15c)

### Threat awareness program (PM-16)

- The [Chief Information Security Officer] shall implement a threat awareness program. (PM-16)
- The program shall include a capability to share threat intelligence with other organizations. (PM-16)

### Automated means for sharing threat intelligence (PM-16(1))

- The [Security operations team] shall use automated mechanisms to share threat intelligence, such as machine-readable feeds exchanged with sharing partners. (PM-16(1))

### Protecting controlled unclassified information on external systems (PM-17)

- The [Chief Information Security Officer] shall establish policy and procedures to ensure that requirements for protecting controlled unclassified information processed, stored or transmitted on external systems are implemented in accordance with applicable laws, regulations, policies and standards. (PM-17a)
- The [Chief Information Security Officer] shall review and update that policy [Fill in: the frequency at which to review and update the policy. Typical: annually]. (PM-17b)
- The [Chief Information Security Officer] shall review and update those procedures [Fill in: the frequency at which to review and update the procedures. Typical: annually]. (PM-17b)

#### Federal systems

Under [32 CFR 2002.14(h)(2)](https://www.ecfr.gov/current/title-32/section-2002.14), agencies must use NIST SP 800-171 when establishing security requirements to protect CUI's confidentiality on non-federal information systems. [32 CFR 2002.2](https://www.ecfr.gov/current/title-32/section-2002.2) still incorporates the June 2015 edition of SP 800-171 by reference, while NIST's current revision is [SP 800-171 Rev. 3](https://csrc.nist.gov/pubs/sp/800/171/r3/final) (May 2024), so each agreement should name the revision it requires. As of October 2026.

- Each agreement that shares CUI with a non-federal organization shall require the recipient to protect it as 32 CFR 2002.14(h) requires, and shall name the revision of NIST SP 800-171 that applies. (PM-17a)

### Privacy program plan (PM-18)

- The [Senior privacy official] shall develop and disseminate an organization-wide privacy program plan that gives an overview of the privacy program. (PM-18a)
- The plan shall describe the structure of the privacy program and the resources dedicated to it. (PM-18a.1)
- The plan shall give an overview of the requirements for the privacy program, and describe the privacy program management controls and common controls in place or planned to meet them. (PM-18a.2)
- The plan shall include the role of the [Senior privacy official], and identify the roles and responsibilities of other privacy officials and staff. (PM-18a.3)
- The plan shall describe management commitment, compliance, and the strategic goals and objectives of the privacy program. (PM-18a.4)
- The plan shall reflect coordination among the organizational entities responsible for the different aspects of privacy. (PM-18a.5)
- The [Senior leader], as the senior official accountable for the privacy risk the organization incurs, shall approve the plan. (PM-18a.6)
- The [Senior privacy official] shall update the plan [Fill in: the frequency of updates to the privacy program plan. Typical: annually], and to address changes in privacy law and policy, organizational changes, and problems found during plan implementation or privacy control assessments. (PM-18b)

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, requires each agency to develop, maintain and update an organization-wide privacy program plan.

- The plan shall address the changes in federal privacy laws and policy that apply to the agency. (PM-18b)

### Privacy program leadership role (PM-19)

- The [Senior leader] shall appoint a [Senior privacy official] with the authority, mission, accountability and resources to coordinate, develop and implement applicable privacy requirements and manage privacy risk through the organization-wide privacy program. (PM-19)
- The [Senior leader] shall record the appointment in writing. (PM-19)

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016) requires each agency head to designate a Senior Agency Official for Privacy.

- The [Senior privacy official] shall be the Senior Agency Official for Privacy the agency head designates under OMB Circular A-130. (PM-19)

### Dissemination of privacy program information (PM-20)

- The [Senior privacy official] shall maintain a privacy webpage on the organization's principal public website as the central source of information about the privacy program. (PM-20)
- The page shall give the public information about the organization's privacy activities and a way to contact the [Senior privacy official]. (PM-20a)
- The page shall make the organization's privacy practices and reports publicly available. (PM-20b)
- The page shall list a public email address or phone line for feedback and questions to the privacy office. (PM-20c)

#### Federal systems

[OMB M-23-22](https://www.whitehouse.gov/wp-content/uploads/2023/09/M-23-22-Delivering-a-Digital-First-Public-Experience.pdf), Delivering a Digital-First Public Experience (September 2023), requires each agency's privacy program page to be located at `www.[agency].gov/privacy`, as of September 2026.

- The privacy webpage shall be located at the address M-23-22 requires, `www.[agency].gov/privacy`. (PM-20)

### Privacy policies on websites, applications and digital services (PM-20(1))

- The [Senior privacy official] shall ensure a privacy policy is posted on every external-facing website, mobile application and other digital service. (PM-20(1))
- Each privacy policy shall be written in plain language and organized so that it is easy to understand and navigate. (PM-20(1)(a))
- Each privacy policy shall give the public the information it needs to decide whether and how to interact with the organization. (PM-20(1)(b))
- Each privacy policy shall be updated whenever the organization makes a substantive change to the practices it describes, and shall show the date of the latest change. (PM-20(1)(c))

### Accounting of disclosures (PM-21)

- The [Senior privacy official] shall ensure an accurate accounting is kept of each disclosure of personally identifiable information, recording the date, nature and purpose of the disclosure. (PM-21a.1)
- The accounting shall record the name and address, or other contact information, of the individual or organization that received the disclosure. (PM-21a.2)
- The accounting shall be kept for as long as the personally identifiable information is maintained or five years after the disclosure, whichever is longer. (PM-21b)
- The [Senior privacy official] shall make the accounting available, on request, to the individual the information is about. (PM-21c)

#### Federal systems

For records in a Privacy Act system of records, [5 U.S.C. § 552a(c)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim) sets this accounting. It excludes disclosures to agency employees who need the record for their duties (subsection (b)(1)) and disclosures the Freedom of Information Act requires (subsection (b)(2)). It does not require the accounting to be shown to the individual for law enforcement disclosures under subsection (b)(7).

- The [Senior privacy official] shall keep the accounting of disclosures from each system of records as 5 U.S.C. § 552a(c) requires. (PM-21)

### Personally identifiable information quality management (PM-22)

- The [Senior privacy official] shall develop and document organization-wide policies and procedures for reviewing personally identifiable information for accuracy, relevance, timeliness and completeness across the information life cycle. (PM-22a)
- The [Senior privacy official] shall develop and document organization-wide policies and procedures for correcting or deleting inaccurate or outdated personally identifiable information. (PM-22b)
- The [Senior privacy official] shall develop and document organization-wide policies and procedures for notifying individuals or other appropriate entities of corrected or deleted personally identifiable information. (PM-22c)
- The [Senior privacy official] shall develop and document organization-wide policies and procedures for appeals of adverse decisions on correction or deletion requests. (PM-22d)

### Data governance body (PM-23)

- The [Senior leader] shall establish a data governance body made up of [Fill in: the roles of a Data Governance Body. Typical: the chief data officer (chair), the chief information officer, the chief information security officer, the senior privacy official, the records manager and the owners of major data sets], with responsibility for [Fill in: the responsibilities of a Data Governance Body. Typical: setting data governance policy, approving data sharing agreements, and resolving data quality and access issues]. (PM-23)

### Data integrity board (PM-24)

- Where [Organization name] conducts or takes part in a matching program, the [Senior leader] shall establish a data integrity board. (PM-24)
- The board shall review each proposal to conduct or take part in a matching program before the organization commits to it. (PM-24a)
- The board shall review, each year, every matching program the organization took part in. (PM-24b)

#### Federal systems

The Privacy Act requires every agency that conducts or participates in a matching program to establish a Data Integrity Board, which reviews matching proposals and reviews all of the agency's matching programs each year ([5 U.S.C. § 552a(u)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)).

- The data integrity board shall be established, staffed and run as 5 U.S.C. § 552a(u) requires. (PM-24)

### Minimization of personally identifiable information used in testing, training and research (PM-25)

- The [Senior privacy official] shall develop, document and implement policies and procedures for using personally identifiable information in internal testing, training and research. (PM-25a)
- Internal testing, training and research shall use no more personally identifiable information than the purpose needs, and shall use synthetic or de-identified data wherever it serves the purpose. (PM-25b)
- The [Senior privacy official] shall authorize each use of personally identifiable information for internal testing, training or research before it begins. (PM-25c)
- The [Senior privacy official] shall review those policies [Fill in: the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research. Typical: annually] and update them [Fill in: the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research. Typical: annually, and whenever the review finds a change is needed]. (PM-25d)
- The [Senior privacy official] shall review those procedures [Fill in: the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research. Typical: annually] and update them [Fill in: the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research. Typical: annually, and whenever the review finds a change is needed]. (PM-25d)

### Complaint management (PM-26)

- The [Senior privacy official] shall implement a process for receiving and responding to complaints, concerns and questions from individuals about the organization's security and privacy practices. (PM-26)
- The process shall offer ways to file that are easy to use and readily accessible to the public. (PM-26a)
- The process shall tell individuals all the information they need to file a complaint successfully. (PM-26b)
- The process shall track each complaint so that it is reviewed within [Fill in: the time period in which complaints (including concerns or questions) from individuals are to be reviewed. Typical: 5 business days] and addressed within [Fill in: the time period in which complaints (including concerns or questions) from individuals are to be addressed. Typical: 30 days]. (PM-26c)
- The [Senior privacy official] shall acknowledge receipt of each complaint, concern or question within [Fill in: the time period for acknowledging the receipt of complaints. Typical: 3 business days]. (PM-26d)
- The [Senior privacy official] shall respond to each complaint, concern or question within [Fill in: the time period for responding to complaints. Typical: 30 days]. (PM-26e)

### Privacy reporting (PM-27)

- The [Senior privacy official] shall develop [Fill in: privacy reports. Typical: an annual privacy program report, summaries of privacy impact assessments, and breach reports]. (PM-27a)
- The [Senior privacy official] shall disseminate the reports to [Fill in: privacy oversight bodies. Typical: the board of directors or its audit committee, and regulators where law requires], to demonstrate accountability with statutory, regulatory and policy privacy mandates. (PM-27a.1)
- The [Senior privacy official] shall disseminate the reports to [Fill in: officials responsible for monitoring privacy program compliance. Typical: the senior leader, the chief information security officer and general counsel] and other personnel responsible for monitoring privacy program compliance. (PM-27a.2)
- The [Senior privacy official] shall review and update the reports [Fill in: the frequency for reviewing and updating privacy reports. Typical: annually]. (PM-27b)

### Risk framing (PM-28)

- The [Chief Information Security Officer] shall identify and document the assumptions affecting risk assessment, risk response and risk monitoring. (PM-28a.1)
- The [Chief Information Security Officer] shall identify and document the constraints affecting risk assessment, risk response and risk monitoring. (PM-28a.2)
- The [Chief Information Security Officer] shall identify and document the priorities and trade-offs the organization considers in managing risk. (PM-28a.3)
- The [Senior leader] shall set and document the organization's risk tolerance. (PM-28a.4)
- The [Chief Information Security Officer] shall distribute the results of risk framing to [Fill in: the personnel to receive the results of risk framing activities. Typical: authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management]. (PM-28b)
- The [Chief Information Security Officer] shall review and update the risk framing [Fill in: the frequency for reviewing and updating risk framing considerations. Typical: annually, with the risk management strategy]. (PM-28c)

### Risk management program leadership roles (PM-29)

- The [Senior leader] shall appoint a senior accountable official for risk management to align the organization's information security and privacy management processes with its strategic, operational and budgetary planning. (PM-29a)
- The [Senior leader] shall establish a risk executive function to view and analyze risk from an organization-wide perspective and keep risk management consistent across the organization. (PM-29b)

### Supply chain risk management strategy (PM-30)

- The [Chief Information Security Officer] shall develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance and disposal of systems, system components and system services. (PM-30a)
- The [Chief Information Security Officer] shall implement the supply chain risk management strategy consistently across the organization. (PM-30b)
- The [Chief Information Security Officer] shall review and update the supply chain risk management strategy [Fill in: the frequency for reviewing and updating the supply chain risk management strategy. Typical: annually], and whenever organizational changes require it. (PM-30c)

### Suppliers of critical or mission-essential items (PM-30(1))

- The [Chief Information Security Officer] shall identify and prioritize the suppliers of critical or mission-essential technologies, products and services. (PM-30(1))
- The [Chief Information Security Officer] shall assess each of those suppliers for supply chain risk. (PM-30(1))

### Continuous monitoring strategy (PM-31)

- The [Chief Information Security Officer] shall develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that follow it. (PM-31)
- The programs shall monitor these organization-wide metrics: [Fill in: the metrics for organization-wide continuous monitoring. Typical: systems with a current authorization, plan of action items past due, vulnerabilities remediated within the required times, and staff with current security awareness training]. (PM-31a)
- The programs shall monitor control effectiveness [Fill in: the frequencies for monitoring. Typical: continuously for automated controls, and at least monthly for vulnerability, configuration and account data]. (PM-31b)
- The programs shall assess control effectiveness [Fill in: the frequencies for assessing control effectiveness. Typical: a third of each system's controls each year, so every control is assessed at least every three years]. (PM-31b)
- The programs shall monitor the organization-wide metrics on an ongoing basis, as the strategy sets out. (PM-31c)
- The programs shall correlate and analyze the information that control assessments and monitoring produce. (PM-31d)
- The programs shall take response actions to address the results of that analysis. (PM-31e)
- The [Chief Information Security Officer] shall report the security status of organizational systems to [Fill in: the personnel or roles for reporting the security status of organizational systems to. Typical: the senior leader and the authorizing officials] [Fill in: the frequency at which to report the security status of organizational systems. Typical: monthly]. (PM-31f)
- The [Senior privacy official] shall report the privacy status of organizational systems to [Fill in: the personnel or roles for reporting the privacy status of organizational systems to. Typical: the senior leader and the authorizing officials] [Fill in: the frequency at which to report the privacy status of organizational systems. Typical: quarterly]. (PM-31f)

### Purposing (PM-32)

- The [Chief Information Security Officer] shall analyze [Fill in: the systems or system components supporting mission-essential services or functions. Typical: the systems and components that support mission-essential functions, as the business impact analysis identifies them] to ensure their information resources are used consistently with their intended purpose. (PM-32)

## Review and update

- The [Chief Information Security Officer] shall review this policy whenever the program plan is reviewed, and update it when the review finds a change is needed. (PM-1b)

### Federal systems

For federal agencies, this policy carries out the agency-wide information security program required by the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554(b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- The program plan shall carry out the agency-wide information security program that 44 U.S.C. § 3554(b) requires. (PM-1a)