What PM-28 risk framing requires and why organizations struggle with it
When an assessor or customer asks for PM-28 evidence, they want proof that the organization has written down the assumptions, constraints, priorities, trade-offs and risk tolerance that shape how it assesses, responds to and monitors risk, that those results reach the people who need them, and that someone reviews them on a defined schedule. PM-28 is an organization-wide program control, so the answer is a set of documented risk framing decisions, not a system-level configuration. The control has four working parts. Assumptions and constraints are the facts and limits the organization treats as given, such as dependence on specific suppliers, regulatory boundaries, budget ceilings or the age of legacy platforms. Priorities and trade-offs record which objectives win when they conflict, for example availability against the speed of a patch cycle. Risk tolerance states how much residual risk leadership accepts. Distribution and periodic review cover who receives the results and how often they are revisited.
SP 800-53B places Program Management controls outside the low, moderate and high baselines, because they are deployed across the organization and do not depend on a system's impact level. PM-28 is therefore not allocated to those baselines. It does appear in the privacy baseline, which applies to systems regardless of impact level, so an organization that processes PII must be able to show PM-28 evidence even if its security baseline is low. Confirm the current baseline membership in the SP 800-53B profiles before you tell a customer which obligations apply to which systems.
PM-28 is hard for a specific reason: its content is judgment-based and often exists only in executive minutes, risk committee slides or an informal understanding among senior staff. The decisions are real, but they are rarely written in a form an assessor can sample, and they go stale when priorities change. Before an assessment, check whether you can produce a dated document that states the assumptions, the trade-offs leadership accepted, the stated risk tolerance, the distribution list and the last review date, and whether the risk strategy under PM-9 and the enterprise risk decisions match it. If they do not, that gap is the first item to close.
Which decisions and teams fall under PM-28 scope
PM-28 is an organization-wide control, so its scope starts with the organization rather than any one system. The cards below separate the decisions the framing must cover, the roles that own each assumption, and the way the privacy baseline widens applicability for systems that process PII. The related controls CA-7, PM-9, RA-3 and RA-7 are where the framing is fed and where it is consumed.
Organization-wide, not per system
PM-28 sits in the Program Management family, which SP 800-53B describes as deployed across the organization and independent of any system impact level. The framing is therefore a single organizational artifact that individual system risk assessments draw on, not a document rewritten for each application. Check whether your program has one owner for the framing and whether system teams can point to it. If each business unit keeps its own version, assessors will ask how the versions were reconciled.
Security and privacy risk decisions
The framing must record the assumptions and constraints behind security risk decisions, such as which threats the organization plans for and what it accepts. It must also cover privacy risk from processing PII, since the privacy baseline pulls PM-28 into scope. Confirm that security and privacy risk decisions use the same tolerance language, or document where they differ and who resolves the conflict.
Supply chain risk decisions
Supplier concentration, software provenance, and the acceptable trade-offs between speed of acquisition and supplier scrutiny are framing decisions, not only procurement tasks. Record the priorities that guide supplier selection and the constraints, such as data residency or open-source dependency limits, that shape them. Confirm that the supply chain risk strategy referenced in PM-28 assessment objects exists as a document that procurement and engineering both use.
Operational and mission risk decisions
Trade-offs between availability, change velocity and control strictness are operational risk decisions that the framing should capture. Document the priorities for mission-essential services, the tolerance for downtime during patching, and the constraints that limit remediation timing. Ask whether operations leaders signed off on these priorities or whether they are inferred from engineering practice, since assessors interview mission and business owners about this.
Roles that own assumptions
The assessment objects for PM-28 name organizational personnel, including mission, business, and system owners or stewards. Assign a named owner for each assumption, such as the accountable executive for risk tolerance and the system owner for constraints on a specific platform. Confirm that these owners know they hold the assumption and that the risk executive or Senior Accountable Official for Risk Management (PM-29) can see every role's contribution.
Privacy baseline applicability for PII systems
PM-28 is included in the SP 800-53B privacy baseline, which applies regardless of impact level. A system that processes PII can therefore bring PM-28 into scope even if it is categorized low for security. Inventory which systems process PII, then confirm that their owners reference the organization-wide framing and record any privacy-specific assumptions. Ask your privacy office to confirm which systems it considers in scope before the assessment begins.
How an assessor tests PM-28
This table maps how an assessor using SP 800-53A approaches PM-28 Risk framing, from the examine, interview and test methods to the assessment objects they request and the findings that commonly appear. Read it as a preparation checklist: each row names what the assessor will ask to see and where organizations usually fall short.
| Assessment element | What the assessor does | Evidence that passes | Typical finding |
|---|---|---|---|
| Determination statements | Checks each of the 11 SP 800-53A determination statements for PM-28 against the organization's risk framing record | A single risk framing record that addresses every statement, with a traceable link from each statement to its supporting document | Statements answered by documents that do not cover the full scope, leaving gaps the assessor must record as not satisfied |
| Examine: risk framing documentation | Reviews documented assumptions, constraints, priorities, trade-offs and risk tolerance, and the activities that produced them | Dated, versioned framing documents with named approvers and records showing when they were last reviewed | Undated framing documents or drafts with no approval record, so the assessor cannot confirm what was in force |
| Examine: supply chain risk management strategy | Confirms the framing outputs are consistent with the supply chain risk management strategy where the organization maintains one | Cross-references between the framing record and the supply chain strategy, showing shared assumptions and constraints | Framing assumptions about suppliers that contradict the supply chain strategy or are missing from it |
| Interview: mission, business and system owners | Asks owners how they understand the risk tolerance and priorities that apply to their systems and processes | Consistent answers from owners that match the documented tolerance and priorities | Owners describe tolerance differently from the written record, or are unaware the framing exists |
| Interview: distribution recipients | Confirms that defined personnel received the framing results and know how to use them | Distribution lists, transmittal records or portal access logs matched to the defined recipients | Distribution not evidenced: no record that defined personnel received the results |
| Test: procedures for PII processing authorization | Tests whether framing outputs inform the procedures for authorizing, conducting, managing and reviewing PII processing | Authorization records for PII processing that reference the framed risk tolerance and constraints | Privacy authorizations that never refer to the framing outputs, so the link to risk tolerance cannot be shown |
| Test: periodic review and update | Checks that framing is reviewed and updated at the frequency the organization defined | Review records, change history and meeting minutes that fall within the defined frequency | Risk tolerance never approved, or review dates that have passed without an update or recorded decision |
How to build a PM-28 risk framing process step by step
This sequence turns scattered risk inputs into one documented, approved set of risk framing results that the organization distributes to the right people and reviews on a set schedule.
Gather assumptions and constraints from existing assessments
Start by collecting the assumptions and constraints already recorded in system risk assessments, the risk management strategy, supply chain risk documents and privacy impact assessments. Work with the risk owners who wrote them to find statements that repeat across systems, such as dependence on a cloud provider, data residency limits or staffing gaps. Record each item with its source and the risk decisions it affects. The step is done when every assumption and constraint has an owner, a source reference and a note on how it affects assessment, response or monitoring.
Draft priorities and trade-offs for review
Using the consolidated list, the risk function drafts the priorities the organization sets for managing risk and the trade-offs it accepts, such as paying for faster patching in exchange for a later feature release. Each trade-off should name what is given up and who carries the residual risk. The output is a draft framing document with one section for priorities and one for trade-offs, each traceable to the assumptions it rests on.
Agree priorities and trade-offs with accountable officials
Review the draft with the officials who are accountable for mission, business and system risk, and resolve any conflicts between them. Record the agreed positions, the dissenting views and the rationale for each decision. The step is complete when the accountable officials have signed off the draft or their objections are logged with a decision owner. Keep the meeting record, since an assessor will look for evidence that these people took part.
Define and approve the organization's risk tolerance
Set the risk tolerance the organization will accept, expressed in terms the business can apply, such as the conditions under which a known weakness may stay open and who may approve an exception. Link tolerance statements to the risk management strategy under PM-9 so the two documents do not contradict each other. Obtain formal approval from the senior official the organization designates for risk decisions. The step is done when the approved tolerance statement is version-controlled and referenced by the framing document.
Set distribution recipients for the results
Name the personnel who receive the framing results, normally system owners, risk executives, privacy and supply chain staff and anyone who makes assessment or response decisions. For each recipient, state what they receive, in which format and what action they are expected to take. Store the distribution list alongside the document. The step is complete when a distribution record shows each recipient, the date of issue and the acknowledgment received.
Set the review frequency and triggers
Define how often the framing results are reviewed and updated, and list the events that prompt an earlier review, such as a significant change in the threat environment, a new supplier or a change in mission. The organization sets the frequency itself, so confirm the required interval with the governing authority and your assessor before fixing it. The output is a review schedule and trigger list approved with the framing document.
Schedule and run the first review
Put the first review on the calendar, assign a lead and a set of reviewers, and gather updated assumptions, constraints and tolerance data before the meeting. During the review, confirm that each item is still valid, retire obsolete items and record changes with reasons. Distribute the updated results to the recipients from the previous step. The sequence closes when the review record, the updated framing document and the new distribution acknowledgments are filed together as evidence.
Evidence that passes a PM-28 review
The framing document is the primary artifact for PM-28. It should record the assumptions and constraints that affect risk assessment, risk response and risk monitoring, the organization's priorities and trade-offs for managing risk, and its risk tolerance. An assessor reads it to confirm that each of these elements is present, specific and written down, not implied by other documents. Vague statements such as "we value security" do not show that the organization has framed risk. Version control matters because the assessor needs to see what changed and when.
- Version history: Keep the document in a controlled repository with a version number, change log and the author of each revision.
- Assumptions and constraints: List them explicitly, such as budget limits, regulatory obligations, dependence on third-party platforms or staffing assumptions.
- Priorities and trade-offs: Record which risks the organization accepts in exchange for mission or business outcomes, and why.
- Risk tolerance: State the tolerance in terms the risk program can apply, such as thresholds that trigger escalation.
- Scope statement: Name the organization units, systems and risk categories the framing covers.
Check that the document matches how risk decisions are actually made in the organization, since an assessor will compare it with interview answers and sample decisions.
An approval record shows that someone with the authority to set risk direction reviewed and accepted the framing. The assessor looks for the named approver, their role, the date of approval and the version approved. Approval by a committee is acceptable if the minutes or decision record name the members present and the decision taken. The record should tie to a specific version of the framing document, so that a later edit cannot be mistaken for the approved text.
- Named approver: Record the individual and role, such as the senior accountable official for risk management where the organization has one.
- Approved version: Reference the version number or file hash of the document approved.
- Date: Show the approval date in a format that sorts reliably, and keep it in the same system as the framing document.
- Scope of approval: Confirm whether the approval covers the whole organization or a defined business unit.
- Decision notes: Capture any conditions, objections or deferred items raised at approval.
Confirm with your own governance team which role is the approver under your charter, since PM-28 does not prescribe the title.
PM-28 requires the results to be distributed to defined personnel. The assessor checks two things: that the organization defined who receives the framing, and that distribution actually happened. A distribution list in a policy document is not enough on its own. The record should show recipients, the date sent or published, and how recipients acknowledged or accessed it. Because the control refers to defined personnel, the list of recipients should match the roles that make or carry out risk decisions.
- Defined recipient list: Document the roles and named positions that must receive the framing, and why each needs it.
- Transmission evidence: Keep email records, portal access logs or meeting attendance that show the framing reached those recipients.
- Acknowledgment: Where practical, capture confirmation that recipients read or accepted the framing.
- Dated entries: Each distribution should carry the date and the framing version sent.
- Updates to the list: When roles change, update the recipient list and record the change.
Review the recipient list against your current organization chart before an assessment, since stale recipients are a common finding.
PM-28 requires the framing to be reviewed and updated at a defined frequency. The assessor looks for the frequency you set, evidence that reviews happened on that schedule, and evidence that changes were made when the review found they were needed. A review that confirms the document unchanged still counts as a review, provided it is recorded. Triggers outside the schedule, such as a major incident, a new regulation or a significant change in business direction, should also prompt review, and the assessor may ask how such triggers are handled.
- Defined frequency: State the review interval in the framing document or in the governing policy, so the assessor can test against it.
- Review minutes or sign-off: Record the reviewer, the date and the outcome, including no-change outcomes.
- Change log linkage: Show that revisions following a review carry a new version number and go through approval again.
- Event-driven reviews: Record reviews triggered by incidents, regulatory change or organizational change.
- Open items: Track any review actions to closure in your POA&M process.
Confirm your chosen frequency is one your team can meet, because a missed review date is easy for an assessor to find.
PM-28 sits alongside PM-9, the organization-wide risk management strategy, and RA-3, risk assessment. The NIST catalog lists these as related controls. An assessor will expect the framing to be consistent with the strategy and to inform the risk assessments. Evidence of this linkage is the most useful thing a program can keep, because it shows that framing is used rather than filed. Keep the cross-references explicit so a reviewer can trace an assumption from the framing document to a risk assessment result.
- Strategy alignment: Show that the risk tolerance in the framing matches the risk management strategy under PM-9.
- Assessment inputs: Reference the framing assumptions and constraints used in specific RA-3 risk assessments.
- Traceable decisions: Link risk acceptance decisions back to the stated tolerance and priorities.
- Monitoring feedback: Show that monitoring results from CA-7 or other sources led to framing updates where they changed an assumption.
- Cross-reference index: Maintain a single index that maps each framing element to the PM-9 and RA-3 records that use it.
Spot-check a sample of risk acceptance decisions against the framing before an assessment, since a mismatch is the clearest sign that the framing is not in use.
What meeting PM-28 costs in money and effort
This table breaks down the cost components of PM-28 Risk framing by who is paid, whether each item is one-time or recurring, and what drives it up or down. NIST does not estimate compliance costs, so no figures appear here; use the rows to build the questions you put to a quote.
| Cost component | Who is paid or who spends time | One-time or recurring | What drives it and what to ask for |
|---|---|---|---|
| Senior executive time for risk decisions | Executives who approve assumptions, priorities, trade-offs and risk tolerance | Mostly recurring at each scheduled review | Number of decisions and business lines in scope. Ask the partner how many decision sessions the scope assumes and who must attend. |
| Analyst time to document assumptions and constraints | Internal risk or GRC staff, or a partner if scoped in | One-time for the first framing, then recurring updates | Breadth of the organization and how many risk assessments depend on the framing. Ask for the document list and who drafts each one. |
| Tooling and existing GRC platforms | Software vendors (commercial), or internal staff for self-hosted open-source tools | Licenses or hosting recur; setup is one-time | Whether a GRC or open-source platform already holds risk registers. Ask whether the quote includes hosting, configuration and data migration. |
| External facilitation or independent review | Consultants or advisors who facilitate workshops or review the framing | Usually one-time, with optional periodic review | Whether internal teams have framing experience and how many workshops are needed. Ask for a written scope with deliverables. |
| Distribution and communication | Internal communications, risk committees and system owners | Recurring with each review cycle | Number of defined recipients and channels. Ask how the distribution list and acknowledgment records will be kept. |
| Evidence upkeep | Internal evidence owners and the partner, if retained | Recurring | Review frequency set by the organization and changes in the threat or business environment. Ask who maintains the revision history. |
| Assessor sampling and review | Independent assessors, who are paid by the organization | Recurring at each assessment cycle | Assessment scope, the number of framing artifacts examined and interview time with owners. Ask the assessor for its sampling approach before fieldwork. |
How CISO Assistant supports PM-28 evidence
PM-28 produces documents, decisions and review records rather than system configurations, so the evidence has to be kept somewhere that ties each artifact to a requirement. CISO Assistant can serve as that register when it is self-hosted, but the framework content, mappings and assessment records all need to be checked in the instance before anyone relies on them.
Framework content in the library
CISO Assistant ships more than 200 frameworks, and the question for PM-28 is whether the SP 800-53 Rev. 5 content it loads matches the release your program cites. Before building assessments on it, confirm the catalog version in your instance and check that PM-28 appears with the statement wording you expect. Compare it against the NIST catalog in CPRT rather than trusting the import label alone.
Mapping PM-28 to related controls
PM-28 sits alongside CA-7, PM-9, RA-3 and RA-7 in the Release 5.2.0 catalog, and NIST's OLIR crosswalk links it to six CSF 2.0 subcategories. CISO Assistant offers automatic mapping between frameworks, which can reduce duplicate entry. Treat every automatic link as a proposal: confirm each mapping your auditor will read, and record which mappings your organization has accepted.
Assessment records for risk framing
An assessment in CISO Assistant can hold the PM-28 determination statements and record how each was examined, interviewed or tested, using the methods SP 800-53A defines. Assign an owner to each statement and record the date and the artifact reviewed. The result is a dated trail showing that the risk framing was checked against the organization's own documents, not just marked compliant.
Linking evidence to statements
The documents PM-28 relies on include the risk framing document itself, the distribution record showing who received it, and the review minutes. Attach each file to the specific statement it supports, and keep the version number in the record. Check that attachments are stored in your own infrastructure and that access to them is restricted to the assessment team.
Tracking review and open findings
PM-28 requires periodic review at a frequency the organization defines, so the register needs a dated next-review field and an alert before it lapses. Open gaps should move into a plan of action and milestones with an owner and target date. Confirm in your instance how findings, reminders and status changes are recorded and exported, since these records are what an assessor will ask to see.
Confirming the loaded PM-28 items
Before the first assessment, your team must confirm which PM-28 items are loaded in your instance, how each one is mapped, and whether any were edited or removed during import. Record the check with the date, the name of the reviewer and the catalog version. Mapping and framework content should be validated against NIST's published catalog, because an unverified mapping can make an evidence gap look covered.
Who writes, approves and checks the risk framing
The organization owns PM-28. Its leaders decide which assumptions and constraints shape risk assessment, response and monitoring, how it ranks priorities, where it accepts trade-offs and how much risk it will tolerate. These are management judgments, so they must come from the people accountable for the mission, not from the consultant or the tool. The organization also decides who receives the results and how often the framing is reviewed, which is where the control's defined personnel and defined frequency are set.
- Assumptions and constraints: named decisions such as budget limits, regulatory deadlines, reliance on specific cloud providers or open-source components.
- Risk tolerance and trade-offs: the level of risk leadership accepts, recorded with the rationale and the approver.
- Approval: a signed or otherwise traceable sign-off by the accountable official.
- Distribution list: the defined roles that receive the framing and the channel used.
- Review schedule: the frequency and triggers for updating the framing.
Ask for the approval record and the review date before any assessment begins, because an assessor will look for both.
An implementation partner can help the organization run the workshops that surface assumptions, draft the framing document, and set up the records that hold evidence over time. This is preparation work. The partner does not decide the risk tolerance, does not approve the framing and does not sign anything on the organization's behalf. Its deliverables should be written in a fixed-scope agreement so the organization knows exactly which documents and records are produced.
- Workshop facilitation: structured sessions with mission, business and system owners, with notes captured for the organization to confirm.
- Draft documents: a first version of the framing that leadership edits, challenges and approves.
- Evidence records: versioned storage for approvals, distribution records and review logs, configured in the organization's own environment.
- Traceability: links from each assumption to the risk assessment, response and monitoring activities it affects.
- Handover: training for the staff who will maintain the framing after the engagement ends.
Confirm in the written scope which drafts the partner produces and which parts the organization must write itself.
The independent assessor tests whether PM-28 is in place and working, then reports its findings. It examines documents, interviews personnel and tests procedures against the determination statements in SP 800-53A. The assessor cannot prepare the framing it tests, because a party that wrote the content cannot independently judge it. Where the assessor is hired by the organization, the organization still needs to show that the assessor's role was limited to testing and reporting.
- Examination: reviews the framing document, approval record and distribution evidence for consistency.
- Interviews: asks mission, business and system owners whether they know the framing and use it in decisions.
- Testing: checks whether the review process runs at the defined frequency and changes the framing when triggers occur.
- Findings: reports gaps to the organization, which decides how to respond through its plan of action and milestones.
- Independence: the assessor's report, not the partner's documents, is what carries assessment weight.
Before hiring an assessor, confirm in writing that the firm did not draft the framing and will not be the one making the risk decisions it reviews.
Common PM-28 gaps and how to close them
Most PM-28 weaknesses are not missing documents. They are framing decisions that were made once, never tied to the rest of the risk program, and never checked again. The cards below pair each common gap with a closing action you can verify before an assessor asks.
Tolerance stated only verbally
Leaders often describe risk tolerance in meetings, but nothing in writing says how much risk the organization will accept, for which kinds of systems, or who may accept it. PM-28 expects the risk tolerance itself to be documented. Close the gap by writing tolerance statements per risk category, with the approving official named, and checking that each statement can be applied to a real risk decision.
Framing not linked to PM-9 strategy
PM-28 framing produces assumptions, constraints and priorities that should feed the organization-wide risk management strategy in PM-9. When the two documents disagree, risk decisions are made against one and reported against the other. Close the gap by cross-referencing each framing priority to the PM-9 strategy section it informs, and recording where the two were last reconciled.
No review frequency defined
PM-28 requires review and update at a frequency the organization defines. A framing document with no stated interval, or one that says only "periodically," gives an assessor nothing to test against. Close the gap by setting a specific review interval in the policy, assigning an owner for each review, and keeping a dated record of each completed review and its outcome.
Distribution not evidenced
PM-28 requires the framing results to reach defined personnel, and an assessor will look for proof that they did. Teams often assume that a shared drive or an intranet page counts as distribution. Close the gap by defining the recipient roles, recording who received each version and when, and keeping acknowledgments from system owners and risk decision makers.
Privacy framing missing for PII systems
The SP 800-53B privacy baseline applies to systems that process personally identifiable information regardless of impact level, and PM-28 is part of that baseline. Organizations that frame security risk well often leave out the privacy assumptions, such as purposes of processing, data minimization limits and privacy risk tolerance. Close the gap by adding a privacy section to the framing for each PII system and confirming it with the privacy official.
Assumptions not updated after major change
Assumptions about threats, suppliers, staffing, cloud providers and regulatory scope age quickly. A framing document written before a cloud migration, an acquisition or a new regulation may still describe an environment that no longer exists. Close the gap by listing the change triggers that force a framing update, such as a new supplier tier or a new hosting model, and checking the assumptions against each triggering change.
PM-28 questions buyers ask before hiring help
How much effort does PM-28 risk framing take to document?
Effort depends mostly on how much risk framing already exists in writing. PM-28 requires the organization to document the assumptions and constraints that affect risk assessment, response and monitoring, its priorities and trade-offs, and its risk tolerance. The main drivers are the number of business units and mission areas that must contribute, whether the risk management strategy under PM-9 already states tolerance, how many reviewers must approve drafts, and how distribution to defined personnel is handled. Most of the work is one-time drafting and agreement, followed by recurring review at the frequency the organization sets. NIST does not estimate compliance effort, so ask any provider to break its quote into discovery, drafting, review, distribution and periodic update.
How long does PM-28 risk framing take to complete?
The timeline is set mainly by governance, not by tooling. NIST does not set implementation timelines for SP 800-53. It leaves those to OMB Circular A-130 for federal agencies, and it does not estimate compliance costs. Schedule risk usually comes from getting executives to agree on risk tolerance, from waiting for mission and system owners to validate assumptions, and from aligning the output with existing risk management and POA&M processes. A well-scoped engagement states its milestones in writing before work starts, so ask for dated deliverables, named reviewers and the review cycle the organization will keep afterward. If a contract or agency sets a deadline, confirm which document it expects and plan backward from that date.
What does PM-28 risk framing require from executives?
Executives must own the decisions, even when staff draft the text. The organization owns its controls, so senior leaders need to confirm the risk tolerance, the priorities and the trade-offs the framing records. Without that sign-off, the document is only one team's view and is unlikely to hold up at review. Expect to commit time to a decision session, to approve the list of defined personnel who receive the results, and to set the review frequency. These decisions feed PM-9 and the related controls CA-7, RA-3 and RA-7, so the same leaders will see the framing again in risk reporting and monitoring.
Can our team complete PM-28 risk framing without outside help?
Yes, a team with risk management experience can document PM-28 alone, provided it has the authority to ask executives for decisions. The control is organization-owned, and the requirement does not call for an outside firm to sign it off. Check three things before starting: whether anyone has run an organization-wide risk assessment before, whether the team can reach mission and business owners, and whether the output will be assessed against the 11 determination statements in SP 800-53A. Teams without this experience usually struggle most with tolerance and trade-off language, which are judgment calls that paperwork cannot settle.
What does an implementation partner add to PM-28 work?
A partner adds preparation, structure and evidence handling, but not the decisions or the audit opinion. DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own environment, and it prepares systems, controls and evidence for compliance assessments. For PM-28, that can mean structuring the framing document, linking it to the related controls, collecting distribution and review records, and setting up a recurring review cycle. DeployOpen does not issue audit reports, attestations or certifications. Independent assessors make that determination. Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work starts.
Is PM-28 tested for low or moderate impact systems?
PM-28 is not allocated to the low, moderate or high baselines. SP 800-53B describes Program Management controls as deployed organization-wide and independent of system impact level, so a low, moderate or high system does not receive PM-28 as a system control. PM-28 is included in the privacy baseline, which applies to systems regardless of impact level. Confirm with the agency, contract or assessor which baseline and which scope they require. If the privacy baseline applies, PM-28 is in scope for those systems, and the assessor will look for the organization-wide framing document that supports them.
What does an assessor need from us for PM-28?
The assessor needs documents, access to people and evidence of practice. SP 800-53A assesses PM-28 through 11 determination statements using examine, interview and test methods. Expect requests for the supply chain risk management strategy and documentation of risk framing activities, interviews with personnel including mission, business and system owners, and tests of the procedures and practices for authorizing, conducting, managing and reviewing PII processing. Prepare a document index, a named contact for each interview, minutes from framing sessions, and distribution and review records. The independent assessor performs the assessment and decides the findings.
Which open-source tool can track PM-28 evidence and reviews?
A GRC platform can track PM-28 evidence, but it does not decide risk tolerance. CISO Assistant is licensed under AGPL-3.0-only, ships more than 200 frameworks and runs audits and compliance assessments with automatic mapping between frameworks, according to its CISO Assistant README. Confirm in the release you plan to use whether its NIST SP 800-53 content covers PM-28 at the determination-statement level before relying on it. Self-hosted tooling keeps framing documents, approvals and review records inside the client's environment. Ask any implementation partner where each evidence item is stored, who approves changes and how reviews are scheduled.
How DeployOpen prepares PM-28 evidence
DeployOpen prepares the systems and evidence that support PM-28 Risk framing inside your own environment, under a fixed-scope written agreement. In practice that means we help you assemble the working record the control asks for: a documented list of the assumptions and constraints that shape risk assessment, response and monitoring, the priorities and trade-offs your leadership has chosen, and the risk tolerance statement those decisions rest on. We can set up the place where these documents live, such as a controlled repository or a self-hosted GRC workspace, define the distribution list of defined personnel, and build the review calendar so the update frequency your organization sets is visible and tracked. The scope, deliverables and timeline are agreed in writing before work starts.
DeployOpen does not decide your risk tolerance, set your priorities, or accept the risk on your behalf. Those are decisions for the accountable officials in your organization, and the assessor will look for proof that they were made by the right people and recorded. Our role is to make that proof easy to produce: we can capture the decision records, link them to the risk management strategy and the related controls NIST lists for PM-28 (CA-7, PM-9, RA-3 and RA-7), and check that the distribution and review steps actually happened. We also do not issue audit reports, attestations or certifications. Independent assessors and certification bodies do that. Before you engage anyone, confirm with your assessor which artifacts they will examine, interview and test for PM-28, since the SP 800-53A procedures name specific assessment objects.
Ongoing support is available as a retainer for organizations that need the framing record kept current after the initial work. A retainer can cover periodic reviews of the assumptions and constraints as the threat picture or business mission changes, updates to the distribution records, and preparation of materials for the next assessment cycle. Ask any provider to state in the quote which items are one-time setup and which recur, who approves changes to the risk tolerance statement, and how the review frequency you choose is reflected in the calendar. Confirm these points against your own governance charter before signing.
