Program Management Policy

Program Management Policy template: Ready-to-adopt Program Management policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and one organization-wide edition.

Type	Program stage	Status	Template version	NIST basis
Policy	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Program Management policy states what the organization requires for program management and who is accountable for it. Its opening sections meet PM-1, and it adds one statement group per control. NIST SP 800-53B allocates no PM control to a security baseline: the organization carries them out once for all its systems, whatever their baselines. So this policy has one organization-wide edition, which every baseline’s starter kit includes.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

The one edition has statements for every control listed. PM-1 is met by the opening sections. “Yes” marks the controls NIST also places in the Privacy baseline.

Control	Title	In the Privacy baseline
PM-1	Information Security Program Plan
PM-2	Information Security Program Leadership Role
PM-3	Information Security and Privacy Resources	Yes
PM-4	Plan of Action and Milestones Process	Yes
PM-5	System Inventory
PM-5(1)	Inventory of Personally Identifiable Information	Yes
PM-6	Measures of Performance	Yes
PM-7	Enterprise Architecture	Yes
PM-7(1)	Offloading
PM-8	Critical Infrastructure Plan	Yes
PM-9	Risk Management Strategy	Yes
PM-10	Authorization Process	Yes
PM-11	Mission and Business Process Definition	Yes
PM-12	Insider Threat Program
PM-13	Security and Privacy Workforce	Yes
PM-14	Testing, Training, and Monitoring	Yes
PM-15	Security and Privacy Groups and Associations
PM-16	Threat Awareness Program
PM-16(1)	Automated Means for Sharing Threat Intelligence
PM-17	Protecting Controlled Unclassified Information on External Systems	Yes
PM-18	Privacy Program Plan	Yes
PM-19	Privacy Program Leadership Role	Yes
PM-20	Dissemination of Privacy Program Information	Yes
PM-20(1)	Privacy Policies on Websites, Applications, and Digital Services	Yes
PM-21	Accounting of Disclosures	Yes
PM-22	Personally Identifiable Information Quality Management	Yes
PM-23	Data Governance Body
PM-24	Data Integrity Board	Yes
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research	Yes
PM-26	Complaint Management	Yes
PM-27	Privacy Reporting	Yes
PM-28	Risk Framing	Yes
PM-29	Risk Management Program Leadership Roles
PM-30	Supply Chain Risk Management Strategy
PM-30(1)	Suppliers of Critical or Mission-essential Items
PM-31	Continuous Monitoring Strategy	Yes
PM-32	Purposing

Decisions to make first

The policy has 35 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who leads the security program, and who approves the program plan and sets the organization’s risk tolerance?	PM-1, PM-2, PM-28	The Chief Information Security Officer leads the program; the senior leader approves the plan and sets risk tolerance.	Senior leader
Who leads the privacy program, and is it combined with another role?	PM-18, PM-19	A senior privacy official who reports to the senior leader. A small organization may give the role to its general counsel or compliance lead.	Senior leader
Which PM controls do not apply, and why?	PM-8, PM-17, PM-24	PM-8 applies only to owners or operators of critical infrastructure, PM-17 only where the organization holds controlled unclassified information, and PM-24 only to organizations that run matching programs. Record each decision in the program plan.	Chief Information Security Officer

Record your values in the Program Management decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Organization-wide	Word · Markdown	Word · Markdown

Everything for this family in one file: PM pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (annotated)

Guidance

PM-1 asks for an organization-wide information security program plan: a document that describes the program, its common controls and who is responsible for what, approved by a senior official. This policy commits the organization to that plan and sets the rules for keeping it. The plan itself is a separate document: start from the Information Security Program Plan template. Program management controls are carried out once for the whole organization; NIST SP 800-53B allocates none of them to a security baseline, so this policy has a single edition whatever the baselines of your systems. Each statement cites the PM-1 item it meets.

Purpose

This policy establishes Organization name’s organization-wide information security program, and states who leads it and how it is planned, resourced and overseen.

Scope

This policy applies to all of Organization name: every system it owns or operates or that is operated on its behalf, the mission and business processes those systems support, and every person with access to them. The program management controls in this policy are carried out once for the organization, and systems inherit them as common controls.

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and for the information security program, and shall approve exceptions to this policy. (PM-1a.2)
• The Senior privacy official shall lead the privacy program and coordinate it with the information security program. (PM-1a.3)
• Each System owner shall use the common controls the program provides and record them as inherited in the system security plan. (PM-1a.1)
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (PM-1a.2)

Management commitment

The Senior leader approves this policy and shall provide the resources the information security and privacy programs need. (PM-1a.2)

Coordination

The Chief Information Security Officer shall coordinate the program with the privacy, legal, human resources, procurement, finance, physical security and mission functions, and record that coordination in the program plan. (PM-1a.3)

Compliance

• This policy and the program plan shall be consistent with the laws, regulations and standards that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (PM-1a.2)
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (PM-1a.2)
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (PM-1a.2)
• Violations of this policy shall be handled through the organization’s sanctions process. (PM-1a.2)

Information security program plan

Guidance

Assessors ask to see the approved plan, its approval date and evidence of the last review. A plan can be one document or a set of documents, as long as the set is identified. The plan lists the common controls the program provides, so system owners can mark them as inherited in each system security plan.

• The Chief Information Security Officer shall develop, maintain and disseminate an organization-wide information security program plan. (PM-1a)
• The plan shall give an overview of the requirements for the security program, and describe the program management controls and common controls in place or planned to meet them. (PM-1a.1)
• The plan shall identify and assign roles and responsibilities, and describe management commitment, coordination among organizational entities, and compliance. (PM-1a.2)
• The plan shall reflect the coordination among the organizational entities responsible for information security. (PM-1a.3)
• The Senior leader, as the senior official accountable for the risk the organization incurs, shall approve the plan. (PM-1a.4)
• The Chief Information Security Officer shall disseminate the approved plan to every system owner and authorizing official and to the leaders of the functions named under Coordination. (PM-1a)
• The Chief Information Security Officer shall review and update the plan Fill in: the frequency at which to review and update the organization-wide information security program plan Typical: annually and following Fill in: events that trigger the review and update of the organization-wide information security program plan Typical: a significant change to the organization’s mission, structure, risk tolerance or systems, a major incident, or a finding from an assessment or audit of the program. (PM-1b)
• The Chief Information Security Officer shall protect the plan from unauthorized disclosure and modification by limiting who can change it and keeping each approved version. (PM-1c)

Policy statements

Guidance

Each statement below comes from the clause for one program management control or enhancement. The reference at the end of each statement names the control item it meets. Where a control does not apply to your organization, keep its heading, replace the statements with the reason, and record the decision in the program plan.

Information security program leadership role (PM-2)

Guidance

PM-2 asks for one named senior official who owns the security program. Assessors look for the appointment in writing (a delegation memo or charter) and for evidence that the official has budget and staff, not just a title.

• The Senior leader shall appoint a Chief Information Security Officer to coordinate, develop, implement and maintain the organization-wide information security program. (PM-2)
• The Senior leader shall record the appointment in writing and give the Chief Information Security Officer the mission and resources the role needs. (PM-2)

Federal systems

FISMA requires the agency head to delegate to the Chief Information Officer the authority to ensure compliance, including designating a senior agency information security officer who has information security duties as that official’s primary duty and heads an office with the mission and resources to assist in ensuring compliance (44 U.S.C. § 3554(a)(3)(A)).

• The Chief Information Security Officer shall be the senior agency information security officer designated under 44 U.S.C. § 3554(a)(3)(A), with information security duties as that official’s primary duty. (PM-2)

Information security and privacy resources (PM-3)

Guidance

PM-3 ties the programs to the budget. Evidence is the security and privacy line items in each capital planning or investment request, and a record of any request that left them out and why.

• The Chief Information Security Officer and the Senior privacy official shall identify the resources the information security and privacy programs need, for each capital planning and investment request. (PM-3a)
• The Senior leader shall include those resources in capital planning and investment requests, and document every exception. (PM-3a)
• The Chief Information Security Officer and the Senior privacy official shall prepare the security and privacy documentation that capital planning and investment requests require under applicable laws, regulations, policies and standards. (PM-3b)
• The Senior leader shall make the planned information security and privacy resources available for expenditure. (PM-3c)

Plan of action and milestones process (PM-4)

Guidance

PM-4 is the organization-level process; CA-5 is each system’s plan of action and milestones (POA&M). Use one format across systems, such as the POA&M template, so the program can roll items up and compare them against the risk management strategy.

• The Chief Information Security Officer shall maintain a process that ensures plans of action and milestones are developed and maintained for the information security, privacy and supply chain risk management programs and for each organizational system. (PM-4a.1)
• Each plan of action and milestones shall document the remedial actions planned to respond to risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-4a.2)
• The Chief Information Security Officer shall report plans of action and milestones to the Senior leader Fill in: how often, for example quarterly, and to regulators and customers as laws and contracts require. (PM-4a.3)
• The Chief Information Security Officer shall review plans of action and milestones for consistency with the risk management strategy and the organization-wide priorities for risk response. (PM-4b)

System inventory (PM-5)

Guidance

The system inventory is the list of systems the program is responsible for: each with an owner, a categorization, an authorization status and its boundary. CM-8 is the component inventory inside each system. Start from the System Inventory template. An assessor compares the inventory with the authorization records, so keep both in step.

• The Chief Information Security Officer shall maintain an inventory of organizational systems and update it Fill in: the frequency at which to update the inventory of organizational systems Typical: quarterly, and whenever a system is authorized, significantly changed or retired. (PM-5)
• Each System owner shall add a system to the inventory before it is authorized or placed in operation. (PM-5)

Federal systems

The Paperwork Reduction Act requires each agency head to maintain an inventory of major information systems, updated at least annually (44 U.S.C. § 3505(c)).

• The Chief Information Security Officer shall update the inventory at least annually and whenever the agency adds, significantly changes or retires a major information system. (PM-5)

Inventory of personally identifiable information (PM-5(1))

• The Senior privacy official shall establish, maintain and update Fill in: the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information Typical: at least annually, and whenever a privacy impact assessment is completed or updated an inventory of all systems, applications and projects that process personally identifiable information. (PM-5(1))

Measures of performance (PM-6)

Guidance

Choose a few measures that show whether the programs work, such as the share of systems with a current authorization, overdue plan of action items, and remediation within the required times. Report the same measures each period so trends show.

• The Chief Information Security Officer shall develop, monitor and report on measures of performance for the information security program. (PM-6)
• The Senior privacy official shall develop, monitor and report on measures of performance for the privacy program. (PM-6)
• The Chief Information Security Officer and the Senior privacy official shall report the results to the Senior leader. (PM-6)

Enterprise architecture (PM-7)

• The Chief Information Security Officer shall ensure the enterprise architecture is developed and maintained with consideration for information security, privacy and the resulting risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-7)
• The Senior privacy official shall review changes to the enterprise architecture that affect the processing of personally identifiable information. (PM-7)

Offloading (PM-7(1))

• Each System owner shall offload Fill in: non-essential functions or services to be offloaded Typical: non-essential services, such as email, file sharing and public web hosting, on systems that support mission-essential functions to other systems, system components or an external provider. (PM-7(1))

Critical infrastructure plan (PM-8)

Guidance

PM-8 applies where the organization owns or operates critical infrastructure or key resources, or helps protect them. If it does neither, keep the heading and record that decision in the program plan.

• The Chief Information Security Officer and the Senior privacy official shall address information security and privacy issues when the organization develops, documents and updates its critical infrastructure and key resources protection plan. (PM-8)

Risk management strategy (PM-9)

Guidance

The risk management strategy says how the organization frames, assesses, responds to and monitors risk, including its risk tolerance (PM-28). Every authorization decision should be traceable to it. Start from the Risk Management Strategy template.

• The Chief Information Security Officer shall develop an organization-wide risk management strategy for security risk to organizational operations and assets, individuals, other organizations and the Nation from the operation and use of organizational systems. (PM-9a.1)
• The strategy shall also address privacy risk to individuals from the authorized processing of personally identifiable information, developed with the Senior privacy official. (PM-9a.2)
• The Senior leader shall approve the strategy. (PM-9a)
• The Chief Information Security Officer shall implement the strategy consistently across the organization. (PM-9b)
• The Chief Information Security Officer shall review and update the strategy Fill in: the frequency at which to review and update the risk management strategy Typical: annually, and whenever organizational changes require it. (PM-9c)

Authorization process (PM-10)

Guidance

PM-10 makes authorization an organization-wide process rather than a one-off per system. The program plan should name who may serve as an authorizing official and how their decisions feed the risk management strategy.

• The Chief Information Security Officer shall manage the security and privacy state of organizational systems, and the environments they operate in, through an authorization process. (PM-10a)
• The Senior leader shall designate the individuals who fill the roles in the risk management process, including an authorizing official for each system. (PM-10b)
• The Chief Information Security Officer shall integrate the authorization process into the organization-wide risk management program. (PM-10c)

Mission and business process definition (PM-11)

• The Senior leader shall ensure the organization’s mission and business processes are defined with consideration for information security, privacy and the resulting risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-11a)
• The Chief Information Security Officer and the Senior privacy official shall determine the information protection and personally identifiable information processing needs that arise from those processes. (PM-11b)
• The Senior leader shall review and revise the mission and business processes Fill in: the frequency at which to review and revise the mission and business processes Typical: annually, and whenever the organization changes its mission, structure or major services. (PM-11c)

Insider threat program (PM-12)

Guidance

An insider threat program brings together information that security, human resources, legal and privacy each hold, so that concerning behavior is noticed and handled consistently. Involve the privacy official from the start: the program handles personal information about the workforce.

• The Chief Information Security Officer shall implement an insider threat program. (PM-12)
• The program shall include a cross-discipline insider threat incident handling team, with members from at least security, human resources, legal and privacy. (PM-12)

Federal systems

Executive Order 13587 (October 7, 2011), section 2.1(b), requires the heads of agencies that operate or access classified computer networks to “implement an insider threat detection and prevention program consistent with guidance and standards developed by the Insider Threat Task Force” that section 6 establishes.

• If the agency operates or accesses classified computer networks, the insider threat program shall meet Executive Order 13587, section 2.1(b), and the guidance and standards of the Insider Threat Task Force. (PM-12)

Security and privacy workforce (PM-13)

• The Chief Information Security Officer and the Senior privacy official shall establish a security and privacy workforce development and improvement program. (PM-13)
• The program shall define the knowledge and skills each security and privacy role needs, and the training and development that build them. (PM-13)

Testing, training and monitoring (PM-14)

• The Chief Information Security Officer shall maintain a process that ensures the organization’s plans for security and privacy testing, training and monitoring of organizational systems are developed and maintained. (PM-14a.1)
• The Chief Information Security Officer shall track that those plans continue to be carried out. (PM-14a.2)
• The Chief Information Security Officer shall review the testing, training and monitoring plans for consistency with the risk management strategy and the organization-wide priorities for risk response. (PM-14b)

Security and privacy groups and associations (PM-15)

• The Chief Information Security Officer shall establish and maintain contact with selected security and privacy groups and associations, and record which ones. (PM-15)
• The organization shall use those contacts to support ongoing security and privacy education and training for its personnel. (PM-15a)
• The organization shall use those contacts to stay current with recommended security and privacy practices, techniques and technologies. (PM-15b)
• The organization shall use those contacts to share current security and privacy information, including threats, vulnerabilities and incidents. (PM-15c)

Threat awareness program (PM-16)

• The Chief Information Security Officer shall implement a threat awareness program. (PM-16)
• The program shall include a capability to share threat intelligence with other organizations. (PM-16)

Automated means for sharing threat intelligence (PM-16(1))

• The Security operations team shall use automated mechanisms to share threat intelligence, such as machine-readable feeds exchanged with sharing partners. (PM-16(1))

Protecting controlled unclassified information on external systems (PM-17)

Guidance

Controlled unclassified information (CUI) is information the U.S. government creates or owns that a law, regulation or government-wide policy requires to be protected. PM-17 applies wherever the organization shares CUI with external systems, or holds CUI under a contract or agreement. If it handles no CUI, keep the heading and record that decision in the program plan.

• The Chief Information Security Officer shall establish policy and procedures to ensure that requirements for protecting controlled unclassified information processed, stored or transmitted on external systems are implemented in accordance with applicable laws, regulations, policies and standards. (PM-17a)
• The Chief Information Security Officer shall review and update that policy Fill in: the frequency at which to review and update the policy Typical: annually. (PM-17b)
• The Chief Information Security Officer shall review and update those procedures Fill in: the frequency at which to review and update the procedures Typical: annually. (PM-17b)

Federal systems

Under 32 CFR 2002.14(h)(2), agencies must use NIST SP 800-171 when establishing security requirements to protect CUI’s confidentiality on non-federal information systems. 32 CFR 2002.2 still incorporates the June 2015 edition of SP 800-171 by reference, while NIST’s current revision is SP 800-171 Rev. 3 (May 2024), so each agreement should name the revision it requires. As of October 2026.

• Each agreement that shares CUI with a non-federal organization shall require the recipient to protect it as 32 CFR 2002.14(h) requires, and shall name the revision of NIST SP 800-171 that applies. (PM-17a)

Privacy program plan (PM-18)

Guidance

The privacy program plan is the privacy counterpart of the information security program plan (PM-1). Many organizations keep them as two chapters of one program document; assessors accept that if each chapter meets its own control.

• The Senior privacy official shall develop and disseminate an organization-wide privacy program plan that gives an overview of the privacy program. (PM-18a)
• The plan shall describe the structure of the privacy program and the resources dedicated to it. (PM-18a.1)
• The plan shall give an overview of the requirements for the privacy program, and describe the privacy program management controls and common controls in place or planned to meet them. (PM-18a.2)
• The plan shall include the role of the Senior privacy official, and identify the roles and responsibilities of other privacy officials and staff. (PM-18a.3)
• The plan shall describe management commitment, compliance, and the strategic goals and objectives of the privacy program. (PM-18a.4)
• The plan shall reflect coordination among the organizational entities responsible for the different aspects of privacy. (PM-18a.5)
• The Senior leader, as the senior official accountable for the privacy risk the organization incurs, shall approve the plan. (PM-18a.6)
• The Senior privacy official shall update the plan Fill in: the frequency of updates to the privacy program plan Typical: annually, and to address changes in privacy law and policy, organizational changes, and problems found during plan implementation or privacy control assessments. (PM-18b)

Federal systems

OMB Circular A-130, Appendix II, requires each agency to develop, maintain and update an organization-wide privacy program plan.

• The plan shall address the changes in federal privacy laws and policy that apply to the agency. (PM-18b)

Privacy program leadership role (PM-19)

• The Senior leader shall appoint a Senior privacy official with the authority, mission, accountability and resources to coordinate, develop and implement applicable privacy requirements and manage privacy risk through the organization-wide privacy program. (PM-19)
• The Senior leader shall record the appointment in writing. (PM-19)

Federal systems

OMB Circular A-130 (July 28, 2016) requires each agency head to designate a Senior Agency Official for Privacy.

• The Senior privacy official shall be the Senior Agency Official for Privacy the agency head designates under OMB Circular A-130. (PM-19)

Dissemination of privacy program information (PM-20)

• The Senior privacy official shall maintain a privacy webpage on the organization’s principal public website as the central source of information about the privacy program. (PM-20)
• The page shall give the public information about the organization’s privacy activities and a way to contact the Senior privacy official. (PM-20a)
• The page shall make the organization’s privacy practices and reports publicly available. (PM-20b)
• The page shall list a public email address or phone line for feedback and questions to the privacy office. (PM-20c)

Federal systems

OMB M-23-22, Delivering a Digital-First Public Experience (September 2023), requires each agency’s privacy program page to be located at www.[agency].gov/privacy, as of September 2026.

• The privacy webpage shall be located at the address M-23-22 requires, www.[agency].gov/privacy. (PM-20)

Privacy policies on websites, applications and digital services (PM-20(1))

• The Senior privacy official shall ensure a privacy policy is posted on every external-facing website, mobile application and other digital service. (PM-20(1))
• Each privacy policy shall be written in plain language and organized so that it is easy to understand and navigate. (PM-20(1)(a))
• Each privacy policy shall give the public the information it needs to decide whether and how to interact with the organization. (PM-20(1)(b))
• Each privacy policy shall be updated whenever the organization makes a substantive change to the practices it describes, and shall show the date of the latest change. (PM-20(1)(c))

Accounting of disclosures (PM-21)

Guidance

The retention period in PM-21b is fixed by NIST’s control text, not a parameter. Keep the accounting where it can be searched by individual, so a request under PM-21c can be answered.

• The Senior privacy official shall ensure an accurate accounting is kept of each disclosure of personally identifiable information, recording the date, nature and purpose of the disclosure. (PM-21a.1)
• The accounting shall record the name and address, or other contact information, of the individual or organization that received the disclosure. (PM-21a.2)
• The accounting shall be kept for as long as the personally identifiable information is maintained or five years after the disclosure, whichever is longer. (PM-21b)
• The Senior privacy official shall make the accounting available, on request, to the individual the information is about. (PM-21c)

Federal systems

For records in a Privacy Act system of records, 5 U.S.C. § 552a(c) sets this accounting. It excludes disclosures to agency employees who need the record for their duties (subsection (b)(1)) and disclosures the Freedom of Information Act requires (subsection (b)(2)). It does not require the accounting to be shown to the individual for law enforcement disclosures under subsection (b)(7).

• The Senior privacy official shall keep the accounting of disclosures from each system of records as 5 U.S.C. § 552a(c) requires. (PM-21)

Personally identifiable information quality management (PM-22)

• The Senior privacy official shall develop and document organization-wide policies and procedures for reviewing personally identifiable information for accuracy, relevance, timeliness and completeness across the information life cycle. (PM-22a)
• The Senior privacy official shall develop and document organization-wide policies and procedures for correcting or deleting inaccurate or outdated personally identifiable information. (PM-22b)
• The Senior privacy official shall develop and document organization-wide policies and procedures for notifying individuals or other appropriate entities of corrected or deleted personally identifiable information. (PM-22c)
• The Senior privacy official shall develop and document organization-wide policies and procedures for appeals of adverse decisions on correction or deletion requests. (PM-22d)

Data governance body (PM-23)

• The Senior leader shall establish a data governance body made up of Fill in: the roles of a Data Governance Body Typical: the chief data officer (chair), the chief information officer, the chief information security officer, the senior privacy official, the records manager and the owners of major data sets, with responsibility for Fill in: the responsibilities of a Data Governance Body Typical: setting data governance policy, approving data sharing agreements, and resolving data quality and access issues. (PM-23)

Data integrity board (PM-24)

Guidance

A matching program is a computerized comparison of records about individuals, typically to establish or check eligibility for a benefit; the term comes from the U.S. Privacy Act. The steps for each matching program are in PT-8, in the PII Processing and Transparency Policy. If the organization runs no matching programs, keep the heading and record that decision in the program plan.

• Where Organization name conducts or takes part in a matching program, the Senior leader shall establish a data integrity board. (PM-24)
• The board shall review each proposal to conduct or take part in a matching program before the organization commits to it. (PM-24a)
• The board shall review, each year, every matching program the organization took part in. (PM-24b)

Federal systems

The Privacy Act requires every agency that conducts or participates in a matching program to establish a Data Integrity Board, which reviews matching proposals and reviews all of the agency’s matching programs each year (5 U.S.C. § 552a(u)).

• The data integrity board shall be established, staffed and run as 5 U.S.C. § 552a(u) requires. (PM-24)

Minimization of personally identifiable information used in testing, training and research (PM-25)

• The Senior privacy official shall develop, document and implement policies and procedures for using personally identifiable information in internal testing, training and research. (PM-25a)
• Internal testing, training and research shall use no more personally identifiable information than the purpose needs, and shall use synthetic or de-identified data wherever it serves the purpose. (PM-25b)
• The Senior privacy official shall authorize each use of personally identifiable information for internal testing, training or research before it begins. (PM-25c)
• The Senior privacy official shall review those policies Fill in: the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research Typical: annually and update them Fill in: the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research Typical: annually, and whenever the review finds a change is needed. (PM-25d)
• The Senior privacy official shall review those procedures Fill in: the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research Typical: annually and update them Fill in: the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research Typical: annually, and whenever the review finds a change is needed. (PM-25d)

Complaint management (PM-26)

• The Senior privacy official shall implement a process for receiving and responding to complaints, concerns and questions from individuals about the organization’s security and privacy practices. (PM-26)
• The process shall offer ways to file that are easy to use and readily accessible to the public. (PM-26a)
• The process shall tell individuals all the information they need to file a complaint successfully. (PM-26b)
• The process shall track each complaint so that it is reviewed within Fill in: the time period in which complaints (including concerns or questions) from individuals are to be reviewed Typical: 5 business days and addressed within Fill in: the time period in which complaints (including concerns or questions) from individuals are to be addressed Typical: 30 days. (PM-26c)
• The Senior privacy official shall acknowledge receipt of each complaint, concern or question within Fill in: the time period for acknowledging the receipt of complaints Typical: 3 business days. (PM-26d)
• The Senior privacy official shall respond to each complaint, concern or question within Fill in: the time period for responding to complaints Typical: 30 days. (PM-26e)

Privacy reporting (PM-27)

• The Senior privacy official shall develop Fill in: privacy reports Typical: an annual privacy program report, summaries of privacy impact assessments, and breach reports. (PM-27a)
• The Senior privacy official shall disseminate the reports to Fill in: privacy oversight bodies Typical: the board of directors or its audit committee, and regulators where law requires, to demonstrate accountability with statutory, regulatory and policy privacy mandates. (PM-27a.1)
• The Senior privacy official shall disseminate the reports to Fill in: officials responsible for monitoring privacy program compliance Typical: the senior leader, the chief information security officer and general counsel and other personnel responsible for monitoring privacy program compliance. (PM-27a.2)
• The Senior privacy official shall review and update the reports Fill in: the frequency for reviewing and updating privacy reports Typical: annually. (PM-27b)

Risk framing (PM-28)

Guidance

Risk framing is the context every risk decision uses: the assumptions, constraints, priorities and risk tolerance. Most organizations record it as a section of the risk management strategy (PM-9).

• The Chief Information Security Officer shall identify and document the assumptions affecting risk assessment, risk response and risk monitoring. (PM-28a.1)
• The Chief Information Security Officer shall identify and document the constraints affecting risk assessment, risk response and risk monitoring. (PM-28a.2)
• The Chief Information Security Officer shall identify and document the priorities and trade-offs the organization considers in managing risk. (PM-28a.3)
• The Senior leader shall set and document the organization’s risk tolerance. (PM-28a.4)
• The Chief Information Security Officer shall distribute the results of risk framing to Fill in: the personnel to receive the results of risk framing activities Typical: authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management. (PM-28b)
• The Chief Information Security Officer shall review and update the risk framing Fill in: the frequency for reviewing and updating risk framing considerations Typical: annually, with the risk management strategy. (PM-28c)

Risk management program leadership roles (PM-29)

• The Senior leader shall appoint a senior accountable official for risk management to align the organization’s information security and privacy management processes with its strategic, operational and budgetary planning. (PM-29a)
• The Senior leader shall establish a risk executive function to view and analyze risk from an organization-wide perspective and keep risk management consistent across the organization. (PM-29b)

Supply chain risk management strategy (PM-30)

Guidance

The supply chain risk management strategy is organization-wide; the supply chain risk management plan (SR-2) applies it to systems. NIST SP 800-161 Rev. 1 describes both (Update 1, November 2024, current as of September 2026).

• The Chief Information Security Officer shall develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance and disposal of systems, system components and system services. (PM-30a)
• The Chief Information Security Officer shall implement the supply chain risk management strategy consistently across the organization. (PM-30b)
• The Chief Information Security Officer shall review and update the supply chain risk management strategy Fill in: the frequency for reviewing and updating the supply chain risk management strategy Typical: annually, and whenever organizational changes require it. (PM-30c)

Suppliers of critical or mission-essential items (PM-30(1))

• The Chief Information Security Officer shall identify and prioritize the suppliers of critical or mission-essential technologies, products and services. (PM-30(1))
• The Chief Information Security Officer shall assess each of those suppliers for supply chain risk. (PM-30(1))

Continuous monitoring strategy (PM-31)

Guidance

The organization-wide strategy sets the metrics and frequencies each system’s continuous monitoring (CA-7) follows. The Continuous Monitoring Strategy template holds both levels. NIST SP 800-137 (September 2011, current as of September 2026) describes how to build it.

• The Chief Information Security Officer shall develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that follow it. (PM-31)
• The programs shall monitor these organization-wide metrics: Fill in: the metrics for organization-wide continuous monitoring Typical: systems with a current authorization, plan of action items past due, vulnerabilities remediated within the required times, and staff with current security awareness training. (PM-31a)
• The programs shall monitor control effectiveness Fill in: the frequencies for monitoring Typical: continuously for automated controls, and at least monthly for vulnerability, configuration and account data. (PM-31b)
• The programs shall assess control effectiveness Fill in: the frequencies for assessing control effectiveness Typical: a third of each system’s controls each year, so every control is assessed at least every three years. (PM-31b)
• The programs shall monitor the organization-wide metrics on an ongoing basis, as the strategy sets out. (PM-31c)
• The programs shall correlate and analyze the information that control assessments and monitoring produce. (PM-31d)
• The programs shall take response actions to address the results of that analysis. (PM-31e)
• The Chief Information Security Officer shall report the security status of organizational systems to Fill in: the personnel or roles for reporting the security status of organizational systems to Typical: the senior leader and the authorizing officials Fill in: the frequency at which to report the security status of organizational systems Typical: monthly. (PM-31f)
• The Senior privacy official shall report the privacy status of organizational systems to Fill in: the personnel or roles for reporting the privacy status of organizational systems to Typical: the senior leader and the authorizing officials Fill in: the frequency at which to report the privacy status of organizational systems Typical: quarterly. (PM-31f)

Purposing (PM-32)

• The Chief Information Security Officer shall analyze Fill in: the systems or system components supporting mission-essential services or functions Typical: the systems and components that support mission-essential functions, as the business impact analysis identifies them to ensure their information resources are used consistently with their intended purpose. (PM-32)

Review and update

• The Chief Information Security Officer shall review this policy whenever the program plan is reviewed, and update it when the review finds a change is needed. (PM-1b)

Federal systems

For federal agencies, this policy carries out the agency-wide information security program required by the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554(b)) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• The program plan shall carry out the agency-wide information security program that 44 U.S.C. § 3554(b) requires. (PM-1a)