PM-23 Data governance body: requirements and evidence

What the PM-23 data governance body requirement asks for

PM-23 requires the organization to establish a Data Governance Body made up of defined roles with defined responsibilities. In practice, an assessor or contract clause asking for PM-23 wants to see a named group, with a stated purpose and membership, that owns how data policies are set, reconciled and enforced across the organization. Having policies alone does not meet the control. The NIST discussion explains the purpose: such a body keeps data policies coherent and balances data utility against security and privacy requirements, so that one department's use of data does not quietly override another's protections. The risk PM-23 addresses is common in organizations that grew by department. Data retention rules may differ between finance, analytics and customer support, access rules may be decided locally by system owners, and a privacy requirement may be honored in one platform and ignored in another. Without a body that can weigh these conflicts, decisions about data utility, such as opening a dataset for reporting or AI training, are made unevenly and often without a record. The difficulty is authority: the people who need to agree, typically the chief information officer, the senior agency information security officer and the senior agency official for privacy as the assessment procedure names them, rarely report to the same executive, so the body needs a charter that gives it real decision rights and a way to record what it decided. The organization owns the Data Governance Body, its membership and its decisions. An implementation partner can help prepare the charter, the meeting records, the request-review log and the reports that an assessor will examine, but the partner does not decide policy or sign off on the control. Before any outside work begins, the reader should confirm who currently holds authority over each data policy, which officials must sit on the body, and where existing governance records already live, since those are the documents an assessor will ask to see first.

Which data decisions and teams the PM-23 body covers

PM-23 asks for a body with defined roles, so the first decision is what it governs and who sits on it. The cards below separate the people, the data, the outside parties and the structural choices that shape how much work the body carries and how coherent its policies remain.

Core officials on the body

SP 800-53A names the chief information officer, the senior agency information security officer and the senior agency official for privacy as officials to interview for PM-23. Confirm in writing who holds each seat, whether the roles are filled by different people or combined, and who chairs the body. A body without a named chair and recorded membership is hard to show to an assessor.

Data domains in scope

List the data categories the body decides on, such as customer records, employee data, financial reporting data and PII. Each domain brings different owners and different privacy and security requirements. Decide whether structured databases, file shares, SaaS platforms and analytics copies all fall under the body, because a body that only sees the production database leaves most data decisions unowned.

Data owners and stewards

Data owners are accountable for how a dataset is used and protected, while stewards handle quality, definitions and day-to-day access requests. The body should set the rules they follow and receive their escalations. Confirm which owners sit on the body, which report to it only, and how stewards record decisions so that the body's policies reach the systems they describe.

Third parties that supply or process data

Cloud providers, analytics vendors, data brokers and outsourced processors can all change how data is stored and used. The body needs a defined route for reviewing their data handling terms and for approving new data sharing. Ask which contracts and information exchange agreements require body review, and how supplier changes reach the body before data moves.

One body or several domain bodies

A single enterprise body keeps policies consistent but can become a bottleneck for specialized domains. Several domain bodies can move faster, provided they report to one parent body with authority to resolve conflicts between them. Document which model applies, the escalation path between levels, and who breaks ties when a utility request conflicts with a privacy or security requirement.

Mission and utility decisions

The body's stated purpose is to balance data utility against security and privacy requirements, so it must review requests that expand analytics, reuse or sharing. Define which decisions require body approval, which the data owner can make alone, and how the body records its reasoning. Records of board decisions and requests to review data are what an assessor will examine.

Why PM-23 sits outside the low, moderate and high baselines

PM-23 is not allocated to the low, moderate or high baselines, and it is not in the privacy baseline. The reason is how SP 800-53B classifies Program Management controls: they are deployed across the organization to support the information security program, and they are independent of any system's impact level. For PM-23 Data governance body, that means one governance body and its charter serve the whole organization. Assessors do not test it once per system at a given impact level. A system owner cannot satisfy it by pointing to a local data steward, and a team should not budget for a separate body for each high-impact system. Confirm with your assessor which organizational documents they will request, because the assessment objects for this control point to the body's establishing documents, charter, plans, reports, meeting records and records of requests to review data.

The practical consequence is that the work sits in the organization's governance layer. Before any assessment, confirm that the body's membership and charter cover the officials the assessment procedure names for interviews, such as the chief information officer, the senior agency information security officer and the senior agency official for privacy, and that their decisions are recorded. The catalog links PM-23 to AT-2, AT-3, PM-19, PM-22, PM-24, PT-7, SI-4 and SI-19. In practice, the body's decisions feed training content, privacy leadership and PII quality rules, and they should be traceable to those controls. Map these links in your own control inventory so that a finding in one area can be routed to the body.

NIST's OLIR crosswalk from CSF 2.0 to SP 800-53 Release 5.2.0 maps PM-23 to CSF subcategories GV.RR-01, GV.RR-02 and ID.AM-08. If your organization reports against the CSF, you can use that mapping as a starting point, but NIST marks the crosswalk as not comprehensive, so verify each mapping against the control text and your own risk program before you rely on it in a report. The reader's next step is to decide where the body sits in the existing governance structure, record that decision in writing, and confirm the scope with whichever independent assessor or internal audit function will test it.

How an assessor tests the data governance body

This table maps each assessment element for PM-23 to what the assessor examines or asks, what a passing result looks like, and where the control commonly fails. Read it as a checklist of evidence to assemble before the assessment starts, since the same records serve both the examine and interview methods.

Assessment element	What the assessor does	What a passing result looks like
Determination statement (single)	Confirms the organization established a Data Governance Body with defined roles and responsibilities, then tests that statement with examine and interview methods	The body is formally established, its roles are defined, and records show it operates as described
Examine: establishing documents	Reviews the documents that create the body and set its membership and mandate	Approved establishing document names the body, its members and its scope of data decisions
Examine: charter of operations	Checks how the body meets, decides and escalates	Charter sets meeting cadence, quorum, decision rights and reporting lines
Examine: plans and reports	Looks for work products the body has produced or reviewed	Dated plans or reports show data policy decisions and their status over time
Examine: board meeting records and decisions	Samples minutes and decision logs against the charter	Minutes show meetings held as scheduled, attendance by named roles and recorded decisions with owners
Examine: records of requests to review data	Traces requests for data use, sharing or policy exceptions to the body	Requests show intake, review outcome and the balance of utility against security and privacy
Interview: officials on the body	Asks members such as the CIO, senior agency information security officer and senior agency official for privacy what they decide and how	Members describe their responsibilities consistently with the charter and recall real decisions
Common finding: paper-only body	Charter exists but meetings, minutes or decisions cannot be produced	Not passing: the body exists in documents only and cannot show operation
Common finding: no recorded decisions	Minutes exist but record attendance without outcomes or follow-up	Not passing: no evidence that data policies were reviewed or changed by the body

How to stand up the body in order

This sequence turns PM-23 from a stated intent into a working body with a mandate, defined members, a charter, a meeting rhythm and a record of decisions that an assessor can examine and interview against.

Confirm the mandate and executive sponsor
The accountable senior official writes a short mandate that states why the Data Governance Body exists, which data sets and policies it covers, and who it reports to. Name one executive sponsor who can resolve disputes between data owners and the security and privacy functions. The step is complete when the mandate is approved and signed, and the signed document is filed where an assessor can examine it. Ask your auditor which signature level they expect for this kind of document.
Define roles and responsibilities for each member
List the officials who sit on the body, such as the chief information officer, the senior agency information security officer and the senior agency official for privacy, as SP 800-53A suggests for interviews. For each seat, write the responsibilities, the decisions the seat can make alone, and the decisions that need the group. Add data owners and data stewards where your data estate needs them. The step closes with a roster and a responsibilities matrix that names each member and their alternate.
Draft the charter of operations
Write the charter that governs how the body works: its scope, quorum, voting or consensus rules, how it balances data utility against security and privacy requirements, and how conflicts are escalated. Map the charter to the policies it governs so that policy owners know where to bring changes. The charter is done when the body has approved it and it has a version number and an approval date. This charter is one of the documents an examiner will look for under PM-23.
Set meeting cadence and decision rights
Set a standing meeting schedule, an agenda template and a rule for who can call an extraordinary session. Record which decisions the body makes, which it recommends to the sponsor and which it refers to individual owners. Publish this as a short decision-rights table attached to the charter. The step is complete when the calendar invitations, agenda template and decision-rights table exist and the members have acknowledged them.
Establish how requests to review data are logged and resolved
Create a single intake log for requests to review data, covering requests from business units, privacy reviews, and security concerns. Each entry should record the requester, the data involved, the decision, the rationale and the owner of any follow-up. Define a target for how requests move through review, and confirm that target with the body and its sponsor rather than copying one from elsewhere. The step is complete when the log exists, has an owner, and has at least one test entry walked through the process.
Reconcile existing data policies into one set
Inventory the data policies that already exist across security, privacy, records management, analytics and procurement. Identify conflicts, duplicate rules and gaps, then have the body agree which policy governs each conflict. Record the outcome in a reconciliation register that shows each original policy, the decision and the revised text. The step is complete when the body has approved a single policy set, with a list of retired documents and the date each was superseded.
Run the first cycle with minutes and decisions recorded
Hold the first scheduled meeting under the charter, work through the intake log and the reconciled policy set, and record minutes that capture attendance, decisions, dissent and actions. Circulate the minutes to members for confirmation and file the approved minutes with the decision log. The step is complete when the minutes are approved and the actions have named owners. These records are the evidence that the body operates as written, and they are what an interviewer will test against the charter.

Evidence that passes PM-23 and how to keep it current

PM-23 is assessed by examining documents and interviewing the officials on the body, so the evidence is mostly paper that shows the body exists, meets and acts. The cards below cover each artifact an assessor is likely to ask for and the routine that keeps it current between assessments. Confirm the exact evidence your assessor will accept before you build the file.

Establishing document

This is the instrument that creates the Data Governance Body and gives it authority, such as a policy, directive or governance resolution signed by a senior official. Check that it names the body, states its purpose of keeping data policies coherent and balancing data utility against security and privacy requirements, and identifies who approved it. Add a review date so the document does not silently age. An assessor will look for the version in force during the assessment period, so keep superseded versions with their effective dates.

Charter of operations

The charter sets out how the body works: its scope, decision rights, quorum, meeting frequency, escalation path and how requests to review data are received. Without it, the establishing document describes an intent but not an operating body. Record the charter's version number and approval date, and set a review date on the charter itself, for example once a year or after a major change in data policy. Note any changes in the revision history so an assessor can see the body adapted rather than stalled.

Membership and role definitions

Assessors interview the officials who serve on the body, so the membership list must match who actually attends. Typical roles named in the assessment procedure include the chief information officer, the senior agency information security officer and the senior agency official for privacy, but your organization may define others. Keep a dated roster with each member's role, responsibilities and alternates. Update it when someone leaves or changes role, and confirm with your assessor which roles they expect to see.

Plans and periodic reports

Plans and reports show the body's work over time, such as an annual data governance plan, priorities for the coming period and status reports to senior leadership on data policy coherence. Each plan should name an owner, a date and the decisions it supports. Reports should show what the body reviewed and what it found. Store them in one controlled location with consistent file names, so the assessor can trace a plan to the reports that followed it.

Board meeting minutes and decisions

Minutes are the most direct proof that the body met and acted. Use a standing agenda with fixed items, such as open requests, policy conflicts, upcoming changes and action items from the last meeting. Keep a dated decision log that records each decision, the rationale, the members present and any dissent. Circulate minutes for approval within a set period after each meeting. Gaps in the meeting record are a common reason an assessor questions whether the body operates.

Log of data review requests and outcomes

This log shows that requests to review data reach the body and receive a documented outcome, whether approved, declined or referred back with conditions. Record the requester, the data set, the security and privacy considerations raised, the decision and the date closed. Reviewing the log each quarter shows whether requests are handled within the timeframes the charter sets. An empty log is hard to defend, so confirm with your assessor how they expect a quiet period to be evidenced.

What a data governance body costs in time and money

This table lists the cost components of standing up and running a PM-23 data governance body, who is paid for each, whether it is one-time or recurring, and what moves it up or down. NIST does not estimate compliance costs, so use the table to shape a written scope and to ask vendors and assessors for itemized quotes.

Cost component	Who carries the cost	One-time or recurring	What drives it up or down
Executive and member time to charter the body	Senior officials on the proposed board, such as the CIO, senior information security officer and senior privacy official	One-time	Up with the number of data domains and officials involved. Down when an existing committee can absorb the mandate.
Executive and member time for recurring meetings	Board members and their delegates	Recurring	Up with meeting frequency and the number of decisions escalated. Down with a clear decision threshold and a standing agenda.
Staff time to draft the charter and terms of reference	Internal policy, legal, security or privacy staff, or an outside consultant if engaged	One-time, with periodic review	Up with unclear ownership of data and legacy governance documents. Down when a charter template from another committee is reused.
Staff time to reconcile existing data policies	Policy owners across security, privacy, records and business units	One-time, then recurring as policies change	Up with the number of policies that conflict on data use, retention or sharing. Down with a maintained policy inventory.
Decision log and document control tooling	Usually the organization, through existing collaboration suites or self-hosted tools	Recurring licensing or hosting, plus setup	Up with the need for custom workflows or integration with other registers. Down when existing tools can hold the charter, minutes and decision records.
External facilitation or policy review	Outside facilitators, governance consultants or legal reviewers, paid under a written scope	Usually one-time, sometimes recurring	Up with the number of third parties and cross-border data flows to review. Down when internal staff hold the subject knowledge.
Assessor time for interviews and records review	The independent assessor, paid under the assessment engagement	Recurring at each assessment cycle	Up with the volume of minutes, decisions and data review requests to sample. Down with organized, complete records kept as the body works.
Third-party data sharing reviews	Business owners and the governance body, with legal input	Recurring	Up with the number of third parties and data sharing agreements. Down with a standard review checklist and a single register of agreements.

Who owns, who prepares and who assesses PM-23

Your organization owns PM-23 in full. The data governance body is a standing group of defined roles, and only your leadership can establish it, appoint its members, give it authority over data policy and decide what it resolves. The assessor will test whether the body exists and works as described, so the decisions and records must come from your own people, not from outside advisers.

Establishing the body: Executive leadership formally creates the body, names its chair and confirms which officials sit on it, such as the chief information officer, the senior agency information security officer and the senior official for privacy where those roles exist.
Making decisions: Members review data policy proposals, resolve conflicts between data utility and security or privacy requirements, and record each decision with its rationale and date.
Keeping the records: Meeting minutes, decision logs, requests for review and plans or reports belong in repositories your staff control and can produce on request.
Maintaining membership: Your team updates appointments when roles change and confirms that members understand their responsibilities.
Operating the charter: Your staff enforce the charter's cadence and escalation paths in practice.

Before the assessment, confirm that each named official can describe the body's purpose and that the records cover the period the assessor will sample.

Where data governance bodies usually fall short

A data governance body on paper rarely fails at its formation. It fails in the records, the decision trail and the review routine that show it works. The six gaps below are the ones assessors most often find when they examine documentation and interview members under PM-23, and each one has a concrete artifact or routine that closes it.

No written charter

The body exists in practice but no document establishes it, sets its scope, or states how it operates. The examine method for PM-23 looks for documentation that establishes the body and its charter of operations. Close the gap with a signed charter that names the body's purpose, its membership, its decision rights, its quorum and how it escalates disputes to senior leadership. Check that the charter is version controlled and that the approving official is recorded.

Members named without responsibilities

Officials appear on a membership list, yet nobody can say what each one must decide, approve or report. PM-23 interview testing asks officials serving on the body to describe their role, so vague answers become findings. Close the gap with a responsibility matrix that assigns each role, such as the chief information officer, the senior agency information security officer and the senior agency official for privacy, a defined set of decisions and a named deputy for absences.

Informal decisions without minutes

Decisions about data sharing, retention or access get made in hallway conversations or chat threads, and no one records them. An assessor who asks for records of board meetings and decisions finds nothing to test. Close the gap with a standing agenda, a minute template that records attendees, the question, the decision, the rationale and the owner of each follow-up action, and a rule that decisions take effect only once minutes are filed.

Unresolved conflicts between security and privacy

Security teams want broader logging and retention, while privacy teams want data minimized and deleted. When the body never resolves these conflicts, each function follows its own policy and data handling becomes incoherent. Close the gap with a recorded conflict register that states each tension, the options weighed, the balance chosen and the policy revised as a result. This register is the clearest evidence that the body balances data utility against security and privacy requirements.

Unrecorded requests to review data

Business units ask the body to approve new uses, sharing or access to datasets, but the requests live in email and nobody tracks the outcome. PM-23 examination specifically looks for records of requests to review data. Close the gap with a request log that captures the requester, the dataset, the purpose, the decision date, the conditions attached and the closing evidence, reviewed at each meeting so no request goes unanswered.

No review cycle after year one

The body meets enthusiastically at launch, then the calendar empties and the charter and policies drift from how data is actually used. Assessors expect the program to show current activity, not a launch-day snapshot. Close the gap with a documented review cycle set in the charter, covering membership changes, charter updates and a periodic check that the data policies still agree with each other, with each review recorded and its outcome filed with the other governance documents.

Questions buyers ask about PM-23

How long does it take to set up a PM-23 data governance body?

The time depends on how many data domains the body covers, how many executives must approve its charter, and whether data ownership already exists in writing. NIST does not set implementation timelines for SP 800-53 controls, and it leaves federal timing to OMB Circular A-130, so any duration you hear should be treated as one organization's plan rather than a standard. Drivers that lengthen setup include unclear data ownership, several overlapping committees, and no existing data inventory. A body that starts with a written charter, named members and a short list of decisions it must make is usually faster to stand up. Ask any partner to show the milestones and the dependencies in the written scope before work starts.

What does a PM-23 data governance body cost to set up?

Costs fall into staff time, executive time, and any outside help. Internal costs include the hours that members spend on charter drafting, meetings, and records, and the time a senior sponsor gives to decisions. External costs apply only if you hire a consultant or implementation partner to draft the charter, design the roles, or prepare evidence. Cost rises with the number of data domains, the number of systems that hold regulated data, and the amount of existing policy that must be reconciled. Figures come only from a written scope and a quote, and the cost table on this page shows the components to compare. Ask each provider to separate one-time setup from recurring meeting and reporting effort.

Can a small team set up a PM-23 data governance body internally?

Yes, a small team can set one up internally, provided the roles and records are defined clearly. The control asks for a body made of defined roles with defined responsibilities, so the core task is writing down who sits on the body, what each member decides, and how decisions are recorded. Check that the charter names a chair, states the meeting cadence, and assigns owners for data policy, privacy, and security. Confirm that meeting minutes, decision logs, and requests to review data are kept in a place an assessor can reach. Small teams often underestimate the records, so set a template for minutes and a register of data review requests on day one.

What do executives and members need to commit to a data governance body?

Executives must give the body authority, not only a name on a chart. The chief information officer, the senior agency information security officer, and the senior official for privacy are the officials the assessment procedure names as interview subjects, so they must be able to speak to the body's decisions. Members need time for regular meetings, time to review data requests, and the mandate to resolve conflicts between data utility and security or privacy requirements. Without a sponsor who can break ties, the body tends to record disagreements instead of resolving them. Confirm in writing who can approve the charter, who can escalate, and how often the body reports to senior leadership.

What will an assessor ask for first when testing PM-23?

An assessor will usually start with documents that establish the body. SP 800-53A Rev. 5 lists examination of documentation for the body, including the establishing document, its charter of operations, plans and reports, records of board meetings and decisions, and records of requests to review data. The assessor will then interview members, typically the chief information officer, the senior agency information security officer, and the senior agency official for privacy, to confirm they understand their roles. Prepare a current charter, approved minutes, a decision log, and a list of data review requests with outcomes. Keep dates consistent across all of them, because gaps between the charter and the records are the first thing an assessor will test.

When should an organization bring in an implementation partner for PM-23?

Bring in a partner when internal staff lack time, when data ownership is contested, or when the body must connect to systems, evidence repositories, or existing governance tools. A partner can prepare the charter, map roles to data domains, design the evidence folders, and run a readiness review before an assessment. A partner does not issue reports or certificates, and the independent assessor or certification body still performs the assessment. The written scope should list the data domains covered, the documents to be delivered, the roles to be defined, the meetings to be facilitated or observed, the evidence to be prepared, and the responsibilities that stay with your organization. Also confirm how changes to scope are priced and approved before work begins.

How DeployOpen prepares PM-23 governance evidence

DeployOpen helps organizations set up the working parts of a data governance body so that PM-23 evidence exists and can be examined. The organization keeps ownership of its governance decisions, and an independent assessor decides whether the control is met.

How we scope

Confirm which data domains, systems and business units the governance body will cover in the written scope
Agree the membership roles the body needs, such as the chief information officer, senior information security officer and senior privacy official
Define which governance records the assessor will examine, including charter, meeting minutes and data review requests
Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts

How we build

Draft a governance body charter that sets purpose, membership, decision rights and how utility and security trade-offs are escalated
Configure a request and review workflow for data access and use questions, with records kept in the client's own infrastructure
Set up a meeting record template and decision log so each governance action leaves an examinable trail
Align the charter with the organization's existing data policies so the governance body keeps those policies consistent

How we hand over

Deliver the charter, role descriptions, workflow configuration and decision log templates as documented artifacts
Provide an evidence map showing which document or record answers each PM-23 assessment objective
Walk the client's owners through the records they must keep, and note gaps the organization still needs to close
Confirm with the client's assessor which artifacts they expect before the review so the evidence format is agreed early

How we support

Ongoing support, upgrades and continuous testing are available as a retainer for the governance tooling and records
Review the charter and decision log on a schedule the client sets, so changes to roles or policies are recorded
Update the evidence map when the organization changes its data policies, systems or governance membership
Ask the independent assessor to confirm the scope of any review, since DeployOpen does not issue audit reports or attestations