Program Management Decision Worksheet

Program Management Decision Worksheet template: Every decision the Program Management family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, for the whole organization, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Program Management family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every PM control, with a typical value where the Program Management Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Organization-wide	CSV

Decisions

38 decisions.

Decision	Control	Typical value	Who decides
Who leads the security program, and who approves the program plan and sets the organization’s risk tolerance?	PM-1, PM-2, PM-28	The Chief Information Security Officer leads the program; the senior leader approves the plan and sets risk tolerance.	Senior leader
Who leads the privacy program, and is it combined with another role?	PM-18, PM-19	A senior privacy official who reports to the senior leader. A small organization may give the role to its general counsel or compliance lead.	Senior leader
Which PM controls do not apply, and why?	PM-8, PM-17, PM-24	PM-8 applies only to owners or operators of critical infrastructure, PM-17 only where the organization holds controlled unclassified information, and PM-24 only to organizations that run matching programs. Record each decision in the program plan.	Chief Information Security Officer
The frequency at which to review and update the organization-wide information security program plan	PM-1	Annually	Chief Information Security Officer
Events that trigger the review and update of the organization-wide information security program plan	PM-1	A significant change to the organization’s mission, structure, risk tolerance or systems, a major incident, or a finding from an assessment or audit of the program	Chief Information Security Officer
The frequency at which to update the inventory of organizational systems	PM-5	Quarterly, and whenever a system is authorized, significantly changed or retired	Chief Information Security Officer
The frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information	PM-5(1)	At least annually, and whenever a privacy impact assessment is completed or updated	Chief Information Security Officer
Non-essential functions or services to be offloaded	PM-7(1)	Non-essential services, such as email, file sharing and public web hosting, on systems that support mission-essential functions	Chief Information Security Officer
The frequency at which to review and update the risk management strategy	PM-9	Annually	Chief Information Security Officer
The frequency at which to review and revise the mission and business processes	PM-11	Annually, and whenever the organization changes its mission, structure or major services	Chief Information Security Officer
The frequency at which to review and update the policy	PM-17	Annually	Chief Information Security Officer
The frequency at which to review and update the procedures	PM-17	Annually	Chief Information Security Officer
The frequency of updates to the privacy program plan	PM-18	Annually	Chief Information Security Officer
The roles of a Data Governance Body	PM-23	The chief data officer (chair), the chief information officer, the chief information security officer, the senior privacy official, the records manager and the owners of major data sets	Chief Information Security Officer
The responsibilities of a Data Governance Body	PM-23	Setting data governance policy, approving data sharing agreements, and resolving data quality and access issues	Chief Information Security Officer
The frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research	PM-25	Annually	Chief Information Security Officer
The frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research	PM-25	Annually, and whenever the review finds a change is needed	Chief Information Security Officer
The frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research	PM-25	Annually	Chief Information Security Officer
The frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research	PM-25	Annually, and whenever the review finds a change is needed	Chief Information Security Officer
The time period in which complaints (including concerns or questions) from individuals are to be reviewed	PM-26	5 business days	Chief Information Security Officer
The time period in which complaints (including concerns or questions) from individuals are to be addressed	PM-26	30 days	Chief Information Security Officer
The time period for acknowledging the receipt of complaints	PM-26	3 business days	Chief Information Security Officer
The time period for responding to complaints	PM-26	30 days	Chief Information Security Officer
Privacy reports	PM-27	An annual privacy program report, summaries of privacy impact assessments, and breach reports	Chief Information Security Officer
Privacy oversight bodies	PM-27	The board of directors or its audit committee, and regulators where law requires	Chief Information Security Officer
Officials responsible for monitoring privacy program compliance	PM-27	The senior leader, the chief information security officer and general counsel	Chief Information Security Officer
The frequency for reviewing and updating privacy reports	PM-27	Annually	Chief Information Security Officer
The personnel to receive the results of risk framing activities	PM-28	Authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management	Chief Information Security Officer
The frequency for reviewing and updating risk framing considerations	PM-28	Annually, with the risk management strategy	Chief Information Security Officer
The frequency for reviewing and updating the supply chain risk management strategy	PM-30	Annually	Chief Information Security Officer
The metrics for organization-wide continuous monitoring	PM-31	Systems with a current authorization, plan of action items past due, vulnerabilities remediated within the required times, and staff with current security awareness training	Chief Information Security Officer
The frequencies for monitoring	PM-31	Continuously for automated controls, and at least monthly for vulnerability, configuration and account data	Chief Information Security Officer
The frequencies for assessing control effectiveness	PM-31	A third of each system’s controls each year, so every control is assessed at least every three years	Chief Information Security Officer
The personnel or roles for reporting the security status of organizational systems to	PM-31	The senior leader and the authorizing officials	Chief Information Security Officer
The personnel or roles for reporting the privacy status of organizational systems to	PM-31	The senior leader and the authorizing officials	Chief Information Security Officer
The frequency at which to report the security status of organizational systems	PM-31	Monthly	Chief Information Security Officer
The frequency at which to report the privacy status of organizational systems	PM-31	Quarterly	Chief Information Security Officer
The systems or system components supporting mission-essential services or functions	PM-32	The systems and components that support mission-essential functions, as the business impact analysis identifies them	Chief Information Security Officer