PM-13 Security and privacy workforce: requirements and evidence

What PM-13 asks for and why PM-13 security workforce programs stall

When an audit, customer contract or agency requirement pulls SP 800-53 into scope and PM-13 appears on the control list, the organization needs a security and privacy workforce development and improvement program. PM-13 asks for that program to exist and to be run, not for a single training course to be bought. The program defines the knowledge, skills and abilities (KSAs) that security and privacy roles need, provides role-based training, and sets standards for how individuals build and prove their qualifications. It sits in the Program Management (PM) family, which NIST describes as organization-wide controls that support the information security program rather than controls attached to one system. That placement matters because an assessor will look for the program at the enterprise level, with its own documentation and owners, and will not accept a system-by-system workforce plan as a substitute.

PM-13 is easy to confuse with AT, the awareness and training family, and the difference shapes what you build. AT covers what individual users and specialized staff must be taught and when, including training records. PM-13 sits one level above that: it asks how the organization decides what its security and privacy workforce must know, how it closes gaps across roles, and how it improves the program over time. SP 800-53B does not allocate PM-13 to the low, moderate or high baselines because Program Management controls are independent of system impact level. PM-13 does appear in the privacy baseline, which applies to systems regardless of impact level, so an organization with privacy-relevant systems should confirm that the control is in scope for its selected baseline. Check this against the current SP 800-53B profiles rather than relying on memory of an earlier release.

Programs stall for predictable reasons. Teams buy a catalog of courses and treat completion as the answer, but an assessor reviewing PM-13 looks for a defined KSA model, a mapping of roles to those KSAs, the gaps found between the two, and records showing how gaps were closed and reviewed. Without a role inventory that the security function owns, nobody can say which staff need which qualifications. Without a qualification standard, certificates and course completions cannot show that a person meets a role requirement. Ownership is the other common failure: the program needs a named accountable owner, usually working with human resources and the business units that employ security staff. Before committing budget, confirm who will maintain the KSA model after the first assessment, because the model is what turns training activity into evidence that the workforce program exists.

Which roles, teams and baselines PM-13 touches

PM-13 is an organization-wide program control, so its scope is set by who in the organization needs defined knowledge, skills and abilities, not by which systems are in a boundary. The cards below cover the decisions that determine that scope: where the control sits in the baselines, which roles need defined KSAs, and how outside workforces fit in.

Organization-wide scope, not per system

PM-13 is a program-level control. The workforce program covers the security and privacy staff who support every system the organization runs, so it is not rebuilt for each authorization boundary. Confirm who owns the program document, who approves it and how it is reviewed, because an assessor will look for one program rather than a set of system-level training plans. Record which systems and business units the program reaches, so the scope is explicit when an assessor asks.

Privacy baseline inclusion regardless of impact

SP 800-53B does not allocate PM-13 to the low, moderate or high security baselines. It does include PM-13 in the privacy baseline, which applies irrespective of system impact level. An organization handling PII therefore needs the workforce program even if its systems are categorized low for security. Check whether your privacy staff, not only your security staff, are covered by the defined KSAs and role-based development.

Security roles that need defined KSAs

Start with the roles that run controls directly: security operations, incident response, vulnerability management, security architecture and the senior security official. For each role, document the knowledge, skills and abilities it requires, the qualifications expected and the role-based training that builds them. Keep this list short enough to maintain, and tie each role to the PM and control families it operates so the definitions can be checked against actual responsibilities.

Privacy and engineering roles

Privacy officers, privacy engineers and the engineers who build or change systems that process PII all carry privacy risk into daily work. PM-13 expects the program to define what these people need to know and be able to do, not only what security staff need. Engineering roles are often missed. Confirm that developers, product owners and data owners who handle PII have defined qualifications and role-based training, and that the program reaches them through their own development paths.

IT operations and platform roles

System administrators, platform engineers and IT operations staff implement many configuration, access and monitoring controls day to day. Their KSAs determine whether those controls work as designed. Document the skills needed to administer the self-hosted platforms in your environment, including hardening, logging and backup, and link them to the role-based training that maintains them. Review the definitions when a platform, tool or hosting model changes, since new technology often changes the skills required.

Contractors and managed service providers

Contractors and managed service providers often perform security-relevant work inside the organization's boundary without being employees. The organization decides whether their KSAs are defined in the same program, required by contract, or verified through the provider's own program. Write the expectation into the acquisition terms and ask the provider for evidence of qualifications and training records. Confirm who holds the records, since an assessor will ask the organization to show them, not the provider.

How an assessor tests PM-13 under SP 800-53A

This table shows how an assessor applies the examine, interview and test methods from SP 800-53A Rev. 5 to the two determination statements for PM-13. Read each row as one method, what the assessor asks for, the evidence they expect and where workforce programs commonly fall short.

Method	What the assessor asks for	Evidence requested	Common findings
Examine	Documentation of the security and privacy workforce development and improvement program, including how it defines knowledge, skills and abilities and sets qualification standards.	Approved program document, KSA definitions by role, qualification standards, career path documentation and review records.	Program described in general terms with no role-level KSAs, or a document that is not approved or dated.
Interview	Personnel responsible for running the workforce development program explain how it is governed, funded and updated.	Named program owner, role descriptions, meeting or review minutes and examples of how feedback changed the program.	Owners cannot describe the program, or staff describe training that is not part of any documented program.
Test	The organization's processes for implementing the program are followed in practice, such as assigning role-based training and tracking progress against qualification standards.	Training assignment records, completion reports, skills assessment results and a sample of individual qualification records.	Processes exist on paper but records do not show that role-based development was delivered or checked.
Determination statement 1 (program defined)	The assessor confirms the organization has established a security and privacy workforce development and improvement program.	Program charter or policy with scope covering security and privacy roles, plus evidence of management approval.	Only awareness training is documented, which the AT family covers, so the development program itself is missing.
Determination statement 2 (program implemented)	The assessor confirms the program is carried out, with workforce development and improvement actions that the organization can trace.	Records of implemented actions, improvement decisions made from results and updated KSA or training content.	No evidence of improvement cycles, so the program reads as a plan rather than an operating process.

Building a PM-13 workforce development program step by step

This sequence turns PM-13 from a policy statement into a working program: it defines the roles and skills the organization needs, connects them to role-based training under AT-2 and AT-3, and feeds results back into workforce planning so each step produces evidence an assessor can examine, interview against and test.

Inventory the security and privacy roles
Start by listing every role that performs security or privacy work, including those where it is only part of the job, such as system owners, developers, help desk staff who handle access requests, and privacy officers. Record each role's responsibilities, the systems and data it touches, and the people who hold it today. Owners are usually the security, privacy and HR leads, working with department managers. The step is done when the inventory is approved and each role has a named owner and a current headcount.
Define knowledge, skills and abilities per role
For each role, write the knowledge, skills and abilities the work requires, stated in terms a manager can observe, such as configuring centralized logging or running a privacy impact assessment. Separate what a role must know on day one from what it builds over time. Security and privacy leads write the draft, and role owners review it against real tasks. The step closes when each role has a written KSA profile and the profiles are stored with the workforce program documentation that an assessor will examine.
Map role-based training to each KSA gap
Compare each person's current capability with the KSA profile to find gaps, then assign role-based training that closes them. This is where PM-13 meets AT-2 (literacy training) and AT-3 (role-based training), which cover the content and delivery of training. Training owners choose courses, internal sessions or practical exercises, such as cyber range scenarios, and record which KSA each one addresses. The output is a training map linking roles, KSAs and courses, reviewed against the AT-2 and AT-3 requirements your organization has adopted.
Set qualification standards and career paths
Define what qualifies a person for each role level, such as completed training, supervised experience, demonstrated skills in a practical test or a recognized external credential where your organization requires one. Then describe how people move between levels and roles, including the time in role and assessment steps, which the organization sets for itself. Workforce, HR and security leadership approve the standards. The step is complete when each role has an approved qualification standard and a documented progression path that staff can read.
Schedule and deliver the program
Put the training map and qualification standards into a calendar with owners, cohorts and delivery methods, and start enrolment. Use your learning management system to assign courses and track completions. Where a course tracks completion automatically, such as Moodle's activity completion, confirm which conditions mark it complete before relying on the report. The output is a running schedule and enrolment records that show who was assigned what, when, and whether it was finished.
Assess results against the qualification standards
Check whether people have reached the required KSAs, using practical assessments, supervisor sign-off and performance on exercises rather than attendance alone. Record the results against each qualification standard and identify anyone who is not yet qualified for their role. The assessment owner is the security or privacy lead, and HR confirms the records. The step closes with a current qualification status for every role holder and a list of open gaps with owners.
Feed results back into the program
Use the qualification results, skill gaps and incident lessons to update the KSA profiles, training map and qualification standards. Review whether the program still matches the roles identified in the first step, especially after organizational changes or new systems. Report the outcomes to the officials who oversee the security and privacy programs, linking this work to PM-6 measures of performance where those measures apply. The program is working when each revision has a dated change record and the next review cycle is scheduled.

How KSA definitions, role-based training and career paths fit together

The short answer is that PM-13 sets the standards and AT-2 and AT-3 deliver against them. PM-13 asks the organization to run a security and privacy workforce development and improvement program, and NIST's discussion places three things inside it: defining the knowledge, skills and abilities (KSAs) the workforce needs, role-based training, and standards for building individual qualifications. Those standards are the part that ties the rest together. A KSA definition for a security engineer, a privacy officer or an incident responder becomes the yardstick for what role-based training must teach, what a qualification must prove and what a career step looks like. Without that shared yardstick, each team builds its own course list and nobody can say whether the workforce is improving.

Awareness and training under AT covers different ground. AT-2 governs security and privacy literacy training for all users, and AT-3 governs role-based training for personnel with significant security responsibilities. The AT controls carry the training content, delivery and records, and PM-13 sits above them as the program that decides what those courses must cover and how competence is judged. In practice, the security team should check that every role-based course traces back to a documented KSA set, that completion records from AT-3 can be matched to the qualification standard for each role, and that the program owner reviews both on a defined cycle. The related controls named in the catalog are AT-2 and AT-3, so an assessor will expect to see that link explicitly.

Career paths are where the program shows whether it works. Confirm with your HR and security leads which roles have documented progression criteria, whether promotion or reassignment depends on meeting a qualification standard, and how gaps found in workforce reviews feed back into training priorities. SP 800-53A assesses PM-13 through examination of the program documentation, interviews with the people who run it and tests of the implementing processes, so the evidence should show a working cycle rather than a one-time document. Learning platforms can record completions and assessment results, but the KSA definitions, qualification decisions and career criteria remain the organization's own governance decisions.

Evidence that passes a PM-13 review

PM-13 is assessed through documents, interviews and process tests, so the evidence has to show a program that exists on paper and runs in practice. The six artifacts below connect: the program defines the KSA catalog, the catalog drives qualification standards and training, and the review loop feeds improvements back into the program.

Written workforce development program

This is the document SP 800-53A points an assessor to first: the information security and privacy workforce development and improvement program. It should name an accountable owner, state the scope (which roles, which teams, which privacy functions), and describe how the program is run and funded. Check that the privacy side is written in, since PM-13 is in the privacy baseline. Keep a version history and a review date, and re-approve the document whenever roles or organizational structure change.

KSA catalog by role

A knowledge, skills and abilities catalog maps each security and privacy role to the knowledge, skills and abilities it needs. It is the core of PM-13 because the NIST discussion frames the program around defining what is needed. Build it from role descriptions, then review it against incidents, audit findings and new tooling. Store it under version control so an assessor can see what changed and when, and tie each change to a named review.

Qualification standards

Qualification standards state how an individual demonstrates a KSA, such as a certification, a supervised task, a lab exercise or a time in role. Write them per role, with the evidence accepted for each standard. Assessors will ask whether standards are applied: pick a sample of staff and confirm the qualification record matches the standard for their role. Recheck standards at a set interval, because a standard that is never applied is hard to defend.

Role-based training records

Training records show that the KSA catalog drives what people learn. Export completion data from the learning platform with the course, the role it supports, the date and the result, then link each course to the KSA it develops. Records are a different evidence type from AT-2 and AT-3 awareness and literacy records, so keep them separate and label them. In a self-hosted LMS such as Moodle, activity completion settings can record that a learner completed or was graded on a module, but confirm each condition is set before relying on the export.

Career path documents

Career path documents describe how a person moves from one role to the next and which qualifications each step requires. They show the program is designed to build capability, not only to deliver one-off courses. Keep them aligned with the KSA catalog and the qualification standards, so every step cites the same KSAs. Update them when a role is added, merged or retired, and record who approved each version.

Review minutes and improvement actions

PM-13 asks for a program that improves, so assessors look for review evidence. Record periodic reviews of the KSA catalog, training effectiveness and qualification outcomes, with attendees, decisions and owners. Track each improvement action to closure with a date and a result. Gaps found in incidents, audits or tabletop exercises should appear here. Minutes that show no action taken are a common weakness, so link each action to a change in the catalog, training or standards.

What a PM-13 workforce program costs to meet

This table lists each cost component of a PM-13 workforce program, who is paid for it, whether it is one-time or recurring, and what drives it up or down. Use it to structure a quote request, since NIST does not publish cost or effort estimates for PM-13 and no supplied figure sets a price.

Cost component	Who is paid or who does the work	One-time or recurring	What drives the cost
Role and KSA analysis	Internal workforce or HR lead, security architects, and any consultant hired to define roles	One-time, then periodic review	Number of security and privacy roles, how many distinct job families exist, and how often roles change
Training content and licenses	Content developers, instructional designers, or commercial course vendors	Mix: content build is one-time, license fees recur	Whether content is built in house or licensed, the number of role-based tracks, and how often material is updated
Learning platform hosting	Infrastructure or platform team, or a managed hosting provider	Recurring	User count, hosting model (self-hosted or subscription), backup and availability requirements, and integration with identity systems
Training records upkeep	Learning administrators and compliance staff	Recurring	Volume of learners, completion tracking rules, and how records link to role qualifications
Qualification review time	Security leads and managers who approve qualification standards and individual qualifications	Recurring, with an initial set-up cost	Number of qualification standards, frequency of review, and how many staff must be assessed each cycle
Auditor sampling and evidence requests	Independent assessor or auditor, and the internal staff who produce evidence	Recurring at each assessment cycle	Number of roles sampled, depth of records requested, and whether evidence is organized before fieldwork
Self-hosted open-source learning tools	Platform team for deployment and upgrades, or an implementation partner for set-up	Mostly one-time set-up, then recurring operations	Shifts license spend to internal or contracted operations effort, so confirm the support model before comparing with subscriptions

How self-hosted Moodle can produce PM-13 training records

Moodle can produce part of the training evidence that PM-13 implementations depend on, but only part. Its activity completion feature (GPL-3.0-or-later) marks an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for that activity. For a security and privacy workforce program, the useful consequence is that completion records can show who finished which role-based course, when, and under which activity conditions. Those records are the raw material for proving that the organization delivers role-based training as part of a development program, not just a general awareness course.

Completion is not qualification. PM-13 asks for a program that defines the knowledge, skills and abilities (KSAs) each role needs and sets standards for building individual qualifications. A learner who views a page or ticks a box has shown activity, not competence. Moodle can record a grade on a practical assessment, and that grade can be tied to a course that maps to a KSA, but the mapping itself, the passing standard, and the decision that a person is qualified for a role still need documented criteria and human review by the accountable owner of the workforce program. Plan for an assessor to ask how each completion condition relates to a defined KSA, and who signed off the standard.

Before relying on Moodle records as evidence, confirm the configuration in your environment. Check which completion conditions are set on each role-based activity, whether grading and completion are linked, whether manual completion is restricted to named reviewers, and whether completion logs and course backups are retained under your records policy. Confirm the license terms that apply to your deployment and any plugins you add, since the core platform's GPL-3.0-or-later license is not the same as the terms of third-party plugins. The official Moodle activity completion API documentation describes how these conditions are evaluated and is the right reference when your administrators configure them.

Who owns PM-13 and what can be outsourced

Your organization owns PM-13 in full. The control asks for a security and privacy workforce development and improvement program, and the decisions that give that program meaning belong to the people accountable for the security and privacy functions. Those decisions include which knowledge, skills and abilities each role needs, which qualifications count as meeting a standard, how training is assigned by role, and how people move between roles. A partner can draft these, but the organization must approve them, fund them, and show that they are used.

Defining KSAs: Approve the knowledge, skill and ability statements for each security and privacy role, tied to actual job duties.
Qualification standards: Decide which certifications, courses or experience levels meet each role's standard, and who grants exceptions.
Career paths: Set the progression steps and the criteria for moving between roles.
Records and funding: Keep approved program documents, training completion records and budget decisions that an assessor can examine.
Review cycle: Assign an owner who reviews the program and updates it when roles or threats change.

Confirm that a named senior official has approved the program in writing and that the approval date is recorded.

Where PM-13 programs usually fall short

PM-13 is easy to satisfy on paper and hard to satisfy in practice. The gaps below share one root cause: the organization has training activity but no defined model of what its security and privacy workforce must be able to do. Each card pairs a gap with the check an assessor or internal reviewer would make and the step that closes it.

Treating PM-13 as the AT course catalog

Many programs point PM-13 at the course list kept for AT-2 and AT-3 and stop there. PM-13 asks for a workforce development and improvement program, which is broader than awareness and role-based courses. Check whether the program says what roles exist, what each role must know, and how workforce gaps are found and closed. Close the gap by documenting the program as its own artifact and linking the AT courses to it as one input, not as the whole program.

No written knowledge, skills and abilities

A program that never defines the knowledge, skills and abilities (KSAs) needed for security and privacy work cannot show what it develops people toward. Assessors interviewing program owners will ask what a security architect or privacy analyst must be able to do and how that was decided. Close the gap with a KSA definition for each defined role, approved by the accountable owner and reviewed when roles or systems change.

Security roles disconnected from privacy roles

Security workforce plans often ignore privacy staff, so the privacy function has no defined skills, training or qualification path. PM-13 covers both security and privacy workforces, and the privacy baseline applies it regardless of impact level. Check whether privacy officers, PII handlers and system owners appear in the role inventory. Close the gap by mapping privacy responsibilities into the same role model and KSA set as the security roles.

Completion records without qualification standards

A dashboard showing that staff finished courses shows participation, not capability. Programs that stop at completion rates cannot say whether a person is qualified for a role. Check whether the program sets a standard a person must meet before taking on a role, such as demonstrated practice or assessed competence, and whether that standard is recorded. Close the gap by pairing each role with qualification criteria and recording who met them and when.

Career paths that do not exist on paper

Without defined progression, the program cannot show how staff move from entry roles to senior ones, and turnover in specialist roles becomes a hidden risk. Check whether the program describes the steps between roles and the development activities tied to each step. Close the gap by documenting the progression for each role family and linking it to the KSAs and qualification standards already defined.

No evidence that the program is reviewed

PM-13 is a development and improvement program, so it must change over time. A program with no review record, no lessons from incidents or assessments, and no changes to KSAs looks static to an assessor. Check for dated review minutes, a list of changes made after each review, and evidence that findings from incidents or assessments reached the workforce plan. Close the gap by setting a review cycle owned by a named official and keeping its outputs.

PM-13 questions buyers ask before hiring help

How much effort does PM-13 take and what drives it?

PM-13 takes as much effort as the organization's security and privacy workforce is large, varied and under-defined today. The effort comes from four pieces: writing down the knowledge, skills and abilities each role needs, designing role-based training and qualification standards, building career paths, and running the program on a recurring cycle. Costs are mostly staff time, with some spend on learning platforms and external courses. The biggest drivers are the number of roles in scope, how many people hold them, whether job families already exist, and how many standards the organization must reflect. NIST does not publish a cost figure for PM-13. Ask any partner to break a quote into role analysis, program design, documentation and handover, and to say which parts recur each year.

How long does a PM-13 program take to set up?

NIST does not set a timeline for PM-13, and no fixed duration applies across organizations. The time depends on scope: how many roles and teams are included, whether existing competency frameworks can be reused, how much stakeholder review the organization requires, and whether the program must be approved by a senior official before it takes effect. A narrow scope covering one security function will move faster than a program covering security, privacy and engineering across several business units. Agree milestones and deliverables in writing before work starts, and ask for the review and approval steps to be listed separately.

Can an in-house team build a PM-13 program without outside help?

Yes, an in-house team can build a PM-13 program, and many organizations do. The work sits naturally with HR, learning and development, and security leadership, because it touches job design, training and career progression. Outside help is most useful when the team lacks time, has no competency framework to adapt, or needs an independent view of role definitions. Whichever path you choose, the organization owns the program and its approval. An implementation partner can prepare role documents, training records and a review cycle, but cannot decide the program's content on the organization's behalf.

What does the security and privacy workforce need from staff?

Staff need to contribute knowledge about their own roles and take part in the program's activities. Practically, that means:

Managers describe the tasks, tools and decisions each role owns.
Subject matter experts review the knowledge, skills and abilities listed for their area.
Learners complete role-based training and any qualification steps the program sets.
Leaders approve career paths and make time for development in planning.

Plan for these commitments up front. Without protected time, role definitions tend to stay on paper and training records show completion without measurable skill change.

Can a partner issue the PM-13 evidence for an audit?

No. A partner can help prepare PM-13 evidence, but only an independent assessor or auditor can test the control and report on it. The organization owns the program, and the partner's role is to prepare systems, documents and records that the assessor will examine, interview staff about and test. For PM-13, that typically includes the workforce development program documentation, records showing the program is running, and evidence that the processes operate as described. Ask the assessor, before work starts, which artifacts they expect and how they will sample them.

How does PM-13 differ from AT-2 and AT-3?

PM-13 sets up the organization-wide program that defines what security and privacy workers need to know and how they become qualified. AT-2 and AT-3 are the training controls that deliver the learning: AT-2 covers security and privacy literacy training for all users, and AT-3 covers role-based training for personnel with significant security or privacy responsibilities. In short, PM-13 designs the workforce program, while AT-2 and AT-3 run and evidence the training. PM-13 is also deployed organization-wide rather than per system, and it sits in the privacy baseline, so it is not allocated to the low, moderate or high security baselines. Check the current control text in the NIST catalog before you map your own evidence.

What evidence will an assessor expect for PM-13?

The assessment procedure for PM-13 has two determination statements, and assessors use examine, interview and test methods. Expect requests for the workforce development and improvement program documentation, interviews with the people who run it, and testing of the processes that carry it out. Useful evidence includes the knowledge, skills and abilities definitions, role-based training plans, completion and qualification records, career path documents, and records of program reviews. Confirm the exact assessment objects in the NIST assessment procedures before you collect anything.

Which tools can help run a PM-13 program?

A learning management system can record training and qualification status, and open-source options exist for this purpose. Moodle, licensed under GPL-3.0-or-later, includes activity completion tracking that marks an activity complete when a learner views it, receives a grade or ticks it manually, depending on the conditions set. That can support evidence of role-based training, but it does not define competencies on its own. Confirm that the platform's completion settings match the qualification standards you have written, and host it inside your own infrastructure.

How DeployOpen prepares PM-13 workforce evidence

DeployOpen works on PM-13 as part of the implementation of self-hosted open-source platforms inside your own infrastructure. We help you set up the workforce development records, training tracks and qualification evidence that an assessor will ask to see, while your organization keeps ownership of the program, its standards and its decisions.

How we scope

Engagements are fixed-scope, with the PM-13 deliverables and systems named in writing before work starts.
We confirm which roles, platforms and training records fall inside the agreed scope and which stay with your HR and learning teams.
Scope documents state who owns the knowledge, skills and abilities definitions and who approves the qualification standards.

How we build

We configure the self-hosted learning platform in your environment so role-based training assignments and completion records are kept centrally.
We set up course structures, completion rules and reporting views that map training to the defined roles and qualification standards.
We test that completion records, grades and manual sign-offs export cleanly for an assessor's examination.

How we hand over

We document the workforce program configuration, role-to-training mappings and record retention steps for your staff to run.
Handover includes the evidence set matched to the examine, interview and test methods in SP 800-53A for PM-13.
Your assessor, not DeployOpen, reviews the evidence and issues any assessment report or conclusion.

How we support

Ongoing support, upgrades and maintenance of the platform and its records are available as a retainer.
We help update role definitions and training content when roles change or when your program review calls for it.
Questions about assessment results or program ownership stay with your accountable officials and your independent assessor.