The SP 800-53 Rev. 5 Program Management family: organization-wide security, privacy, risk and supply chain program controls that are deployed across the organization rather than per system, with privacy baseline status and assessment procedures.
The organization-wide information security program plan: program requirements, program management and common controls, roles and coordination, approval by an accountable senior official, periodic updates and protection of the plan.
Appointing a senior agency information security officer with the mission and resources to run the organization-wide information security program, confirmed through appointment records and role definitions.
Resourcing the security and privacy programs: including their needs in capital planning and investment requests, documenting exceptions, preparing required documentation and making planned resources available to spend.
The organization-level process for plans of action and milestones (POA&Ms) across the security, privacy and supply chain risk management programs: developing, maintaining and reporting them, and reviewing them against the risk strategy.
The organization-wide inventory of systems, updated at a defined frequency, with an inventory of PII as the PM-5(1) enhancement. It covers systems, not the system components inventoried under CM-8.
Outcome-based measures of performance for the security and privacy programs: developing the metrics, monitoring them and reporting results.
Developing and maintaining an enterprise architecture that accounts for security, privacy and resulting risk, with offloading of functions to other systems as an enhancement; system-level architectures under PL-8 align with it.
Addressing security and privacy in the organization's critical infrastructure and key resources protection plan as it is developed, documented and updated.
The organization-wide risk management strategy covering security risk from operating systems and privacy risk from processing PII, implemented consistently and reviewed periodically or when the organization changes.
Managing the security and privacy state of systems through authorization processes, assigning risk management roles, and integrating authorization into the organization-wide risk management program.
Defining mission and business processes with security and privacy risk in mind and deriving information protection and PII processing needs from them, with periodic review.
An insider threat program with a cross-discipline insider threat incident handling team, which organizations handling classified information must have under Executive Order 13587; the NIST discussion adds centralized analysis, user activity monitoring, awareness training and self-assessments.
A security and privacy workforce development and improvement program: defining knowledge, skills and abilities, role-based training, qualification standards and career paths, complementing awareness and training under AT.
An organization-level process to make sure plans for security and privacy testing, training and monitoring are developed, maintained and carried out, and reviewed against the risk management strategy.
Maintaining contact with security and privacy groups and associations to support staff education, keep current with practices and technologies, and share threat, vulnerability and incident information.
A threat awareness program with a cross-organization capability for sharing threat intelligence, with automated sharing as the PM-16(1) enhancement.
Policy and procedures ensuring that requirements for protecting controlled unclassified information (CUI) on external systems are implemented; the NIST discussion points to 32 CFR 2002, where CUI safeguarding requirements are codified.
The organization-wide privacy program plan: structure and resources, requirements and controls, the senior agency official for privacy's role, goals, coordination and senior approval, updated as privacy law and the organization change.
Appointing a senior agency official for privacy with the authority, accountability and resources to run the organization-wide privacy program and manage privacy risk.
A central privacy webpage on the organization's principal public website that publishes privacy practices and reports and gives the public ways to contact privacy officials, with website and app privacy policies as an enhancement.
Keeping an accurate accounting of disclosures of PII, retaining it for a set minimum period and making it available to the individual on request, a requirement federal agencies have under the Privacy Act.
Organization-wide policies and procedures for PII quality: reviewing accuracy, relevance, timeliness and completeness, correcting or deleting bad data, notifying recipients and handling appeals.
Establishing a data governance body with defined roles and responsibilities to keep data policies coherent and balance data utility with security and privacy requirements.
A Data Integrity Board that reviews proposals to conduct or join computer matching programs and reviews all matching programs annually, a federal agency body tied to the computer matching requirements in PT-8.
Limiting the PII used for internal testing, training and research: policies and procedures, minimizing the data, authorizing necessary use and periodic review. It has the most determination statements of any PM control.
A process for receiving and responding to complaints, concerns and questions about security and privacy practices, with accessible mechanisms, tracking, and defined acknowledgment and response times.
Producing privacy reports for oversight bodies and internal officials to demonstrate accountability with privacy mandates and support compliance monitoring, reviewed and updated periodically.
Risk framing at the organization level: documenting assumptions, constraints, priorities, trade-offs and risk tolerance, distributing the results and reviewing them periodically.
Risk management leadership roles: a Senior Accountable Official for Risk Management and a risk executive (function) that views and manages risk organization-wide.
The organization-wide supply chain risk management strategy for the development, acquisition, maintenance and disposal of systems, components and services, with identification of suppliers of critical items as an enhancement.
The organization-wide continuous monitoring strategy and programs: metrics, monitoring and assessment frequencies, ongoing monitoring, correlation and analysis, response actions and status reporting to defined officials.
Purposing: analyzing systems and components that support mission-essential services or functions to confirm they are used for their intended purpose, since use beyond that scope increases threat exposure.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.