PM-3 Information security and privacy resources: requirements and evidence

What PM-3 requires for security and privacy program funding

If an assessor asks you to show that your security and privacy programs are funded, PM-3 is the control they will test. PM-3 requires that the resources for both programs appear in capital planning and investment requests, that any exceptions be documented, that required documentation be prepared as laws and policies demand, and that the planned resources are actually made available to spend. In practice, that means the assessor will want to trace a line from the program's stated needs to a budget request, an approved investment, and a funding release. A plan that exists only in a security team slide deck does not meet the control, and neither does a budget that was requested but never released.

The risk of an underfunded program is concrete. Controls that depend on tooling, staff, logging capacity or testing time quietly degrade when money is short, and the gaps usually surface during an assessment or an incident rather than in a planning meeting. The harder problem is ownership. Capital planning, investment prioritization and budget release are finance and executive processes that the security team does not run. A CISO may be accountable for the program while having little say over when a request enters the cycle, how it is scored, or whether an exception is approved. Confirm with your finance lead which forum decides security investment, what the submission deadlines are, and who signs off on a deferred or declined request.

PM-3 is not allocated to the low, moderate or high baselines in SP 800-53B. It is a program management control, deployed across the organization rather than assigned to individual systems, and it sits in the privacy control baseline, which applies regardless of system impact level. For a privacy program, that means the funding evidence must cover privacy resources as well as security resources. Ask your privacy officials whether their needs appear in the same capital planning submissions, and whether any privacy resource request was declined and recorded as an exception. Your assessor will examine the business cases and processes behind those requests, so keep them current and traceable to the program plan.

Which budgets, teams and documents PM-3 reaches

PM-3 is an organization-wide program control, so its scope follows the security and privacy programs rather than any single system. The cards below cover the budget processes, exceptions, documents and teams that a PM-3 review should trace, and the privacy resourcing that sits inside the same control.

Capital planning and investment requests

Start by listing every process that approves spending: annual budget cycles, capital planning committees, project intake and investment requests for new platforms. PM-3 expects security and privacy needs to appear in these requests, so the assessor will look for them in the paperwork itself. Ask finance which templates carry a security or privacy line item, and confirm whether a request that adds a system without a security cost is routed for review before approval.

Exhibits and business cases

The assessment objects for PM-3 named in SP 800-53A include exhibit 300, exhibit 53 and business cases for capital planning and investment. Organizations that use other names for these artifacts should map them explicitly so that an assessor can find the security and privacy resourcing inside each one. Confirm that the business case template asks for security and privacy costs and that the owner signs off on them.

Documented exceptions

When a funding request is declined, deferred or reduced, the reason and the accepted risk should be written down and approved by a named official. Undocumented cuts are the most common gap an assessor finds under a resourcing control. Keep a register of exceptions with the requesting team, the risk, the approver, the review date and the plan to close the gap, and tie each entry to the relevant POA&M item under PM-4.

Laws and policies that require documents

PM-3 requires the documentation that laws and policies call for to be prepared. The list depends on the sector and the contracts in force, so start with a written inventory: FISMA and OMB Circular A-130 for federal work, and any state, sector or contract rules that set documentation duties. Ask legal and compliance to confirm which documents each rule requires and who owns each one, because the control does not name them.

Finance and procurement roles

Finance controls the budget calendar and the release of planned funds, while procurement controls the contracts that carry security obligations. Both teams need to know when a security or privacy need must be raised, and who signs off on a reduction. Confirm that procurement intake forms ask whether a purchase affects the security or privacy program, and that finance records the funds approved for those needs as available to spend.

Privacy and security program staff

The security and privacy program owners set the resource needs that feed into planning, and PM-3 treats privacy resourcing as part of the same control. The privacy baseline includes PM-3, so privacy needs must be requested and tracked alongside security needs rather than in a separate process. IT operations should also join the review, because they own the tools, licenses and staff hours that the security and privacy programs depend on.

How an assessor tests PM-3 and what they ask to see

This table walks through the SP 800-53A Rev. 5 Release 5.2.0 procedure for PM-3, showing what an assessor examines, whom they interview and what they test, with common findings. Read each row as a question the assessor will put to your program, then check whether your records answer it.

Assessment element	What the assessor does	Evidence to have ready
Determination statements	Assessor checks six determination statements, each tied to a part of PM-3 covering inclusion in capital planning, documented exceptions, required documentation and released resources	A mapping from each determination statement to the document or record that shows it is met
Examine: exhibit 300 and exhibit 53	Reviews the capital planning submissions that show security and privacy resource needs were included in investment requests	Exhibit 300 and exhibit 53 submissions, or the equivalent budget justification forms your organization uses
Examine: business cases	Reviews business cases to confirm security and privacy needs were stated, costed and linked to the program	Business cases with a security and privacy resource section and the sign-off trail
Interview: information security program planners	Asks who plans security program resources, how needs are identified and how requests reach budget decisions	Named roles, planning calendar and minutes from program resourcing discussions
Interview: privacy program planners	Asks the same questions for privacy resources, including how privacy needs are separated from security needs	Privacy resource requests, owners and the process for escalating unfunded needs
Test: capital planning processes	Walks a sample resource request through approval, exception handling and release of funds to confirm the process runs as written	Process documentation, workflow records and the trace from request to approved and released budget
Common finding: requested but not approved	Compares what the program requested with what was approved and asks how the gap was accepted	Decision records showing approval or rejection, with the risk accepted by the responsible official
Common finding: exceptions without records	Looks for resource shortfalls or deviations from plan that have no documented exception or risk acceptance	A documented exception register with the reason, approver and review date for each item
Common finding: approved budgets not released	Checks whether approved security and privacy funds were made available for expenditure and spent as planned	Funding release records and spend reports that match the approved plan

Implementing PM-3 in the capital planning cycle

This sequence takes the security and privacy program's resource needs from the program owners into the capital planning calendar, records what was not funded and why, prepares the documents laws and policies require, and confirms that approved resources are released and tracked. Each step ends with an artifact an assessor can examine.

Define security and privacy resource needs
The senior agency information security officer and the privacy program lead, with the owners of the security and privacy programs, list the people, tools, services and funding the programs need for the coming planning period. Include privacy needs explicitly, because PM-3 is part of the privacy baseline and applies irrespective of system impact level. The step closes with a signed resource needs statement that names each item, its purpose and the program that owns it. Confirm the owners and the planning period with your own governance documents before work starts.
Bring needs into the investment calendar
Map the resource needs to the organization's capital planning and investment request calendar, including the exhibits and business case templates your organization uses for those requests. Confirm the submission dates and approval gates with the finance office, since the calendar is set by your organization and not by NIST. The step closes when each need has a named request or budget line in the investment pipeline. An assessor will look for these entries when testing the capital planning process.
Document exceptions and the reasoning
Where a requested need is deferred, reduced or declined, record the decision, the approver, the risk accepted and the reasoning in writing. Link each exception to the risk register or plan of action and milestones process so that the gap is tracked rather than forgotten. The output is an exceptions log with a decision record for each entry. This is the point where a decision-maker's rationale becomes evidence, so keep it specific to the security and privacy programs.
Prepare required documentation
Prepare the documents that the laws, regulations and internal policies applicable to your organization require for the security and privacy resource decisions. Identify these requirements with legal, privacy and compliance counsel rather than assuming a single source, because the obligations differ by sector and jurisdiction. The output is a documentation checklist, with each required document filed, dated and linked to the investment request it supports. Confirm the documentation list with the owner of each applicable requirement.
Obtain approval from accountable officials
Route the resource package through the approval path defined in your governance model, which typically includes the senior accountable official responsible for the security and privacy programs and the investment committee. Record each approval, the approved amount or scope and any conditions attached. The output is a set of signed approvals or committee minutes that match the approved resource list. Confirm the approval authority in your organization's delegation of authority before submitting.
Release approved resources for expenditure
Once approved, make the funds and resource allocations available to the program owners through the budgeting or procurement system. Confirm that each approved line can be drawn down, and that any conditions from the approval are visible to the people who spend the money. The output is a release record for each approved item, showing the date, the amount or headcount made available and the receiving owner. This is the step that proves the planned resources were actually made available, which is what PM-3 asks for.
Track spending and report back
Track how released resources are spent against each approved line and report variances, unspent funds and unfilled roles to the accountable officials at the cadence set in your governance documents. Feed any shortfall back into the exceptions log and the next planning cycle. The output is a periodic resource tracking report with reconciled spending and a record of the decisions it prompted. Keep these reports, since an assessor testing the process will expect to see that resource planning is revisited, not performed once.

How the budget trail connects requests, approvals and spend

An assessor testing PM-3 Information security and privacy resources follows one chain: a stated security or privacy need, a funded line that answers it, and expenditure that actually happens against that line. Each link needs its own record because each can fail independently. A need can be documented but never requested, a request can be approved but left unfunded, and money can be allocated but never spent on the planned work. The PM-3 requirement is that the resources for the security and privacy programs appear in capital planning and investment requests, that exceptions are documented, that required documentation is prepared, and that planned resources are made available for expenditure. In practice, the reader should be able to pick one planned control improvement, point to the request that asked for it, the approval that accepted or deferred it, and the ledger entries that show what was spent.

The related controls sit beside this chain rather than inside it. PM-4 Plan of action and milestones process covers how weaknesses and their remediation milestones are tracked across the programs, so a POA&M item is often the best evidence of why a funding request exists. SA-2 Allocation of resources addresses resources allocated to the system's security and privacy requirements as part of planning and budgeting for acquisition, and it is the control to review when the funded line is a system-level purchase. The catalog lists these as related controls, but it does not define a mechanical handoff between them, so the organization should document how a PM-4 milestone maps to a PM-3 request and an SA-2 allocation, and who signs off each step.

NIST does not estimate compliance or certification costs and does not set implementation timelines, so the organization must build its own funding basis from its risk strategy, system inventory and the cost of the controls it has chosen. Confirm with finance which fiscal cycle governs requests, what threshold triggers a formal investment review, and how exceptions are recorded when a requested item is deferred. Keep the request, approval and spend records in a system that can be exported at assessment time, and ask your assessor which documents they expect to see for each determination statement. Costs in this area are largely internal staff time and tooling, and they recur each year, so the trail must be maintained as an operating process rather than prepared once for an audit.

Evidence that shows PM-3 is met

PM-3 is tested by following resource decisions from the planning cycle into spend. The artifacts below connect the capital planning submissions, the approvals behind them, the exceptions the organization chose to carry, and the funds actually released, so an assessor can trace one dollar from request to expenditure. Keep each artifact current between assessments, not only in the weeks before one.

Capital planning submissions

These are the budget requests that show security and privacy program needs as line items, not as afterthoughts inside IT budgets. For PM-3, an assessor looks for security and privacy resources named explicitly, with the needs they address and the program owner who submitted them. Check that each submission matches the current program plan under PM-1 and PM-18. Where the organization runs an annual planning cycle, keep the submitted version and the version the governing body received, dated and versioned.

Exhibit 300 and exhibit 53 business cases

Federal agencies use exhibit 300 and exhibit 53 business cases to justify major IT investments and to report IT portfolio spending to OMB. Organizations outside that reporting regime may use equivalent business cases with the same content: the investment purpose, alternatives considered, cost estimates and security and privacy requirements. Ask whether the business case states the security and privacy resources explicitly. Assessors use these documents as assessment objects for the capital planning determination, so they should be retrievable by investment and fiscal year.

Approval records

Approval records show who accepted the security and privacy resource requests and at what level. Keep signed or system-recorded approvals from the officials who own the budget, along with the date and the version approved. PM-3 interviews typically cover the people with information security and privacy program planning responsibilities, so approval records should name them and match their documented roles. Where a request was reduced or deferred, record the decision as well as the original request, since a reduction without a record is hard to defend.

Exception register entries

Every resource request the organization does not fund in full needs an entry in an exception register. Each entry should state the unfunded need, the rationale, the risk accepted, the compensating measures, the approver and the review date. An assessor reading PM-3 checks that exceptions are documented rather than silently absorbed. Tie entries to the plan of action and milestones process under PM-4 so deferred work carries a tracked remediation path and does not disappear from the program.

Required documentation with revision history

PM-3 requires the documentation that laws and policies call for to be prepared, so the register of required documents is evidence in itself. Maintain each document with a version number, an owner, an approval date and a change log showing what changed and why. Documents typically include the program plan, resource justifications and any mandated reports. Confirm which documents your sector, contracts and internal policy require, because the list varies by organization and is not set by this control alone.

Budget release and spend reports

The control requires planned resources to be made available for expenditure, so budget release records are the proof that approved money reached the program. Keep release reports that show the approved amount, the amount released, the date released and the amount spent, by program area. Reconcile approved against released funds each quarter, and log any gap as either an exception or a timing explanation. An assessor will compare these reports against the capital planning submissions to confirm the funded plan matches the plan that was approved.

What meeting PM-3 costs in money and effort

This table breaks down the cost components of meeting PM-3 by role, whether each is one-time or recurring, and what drives it up or down. No figures are given because none are supplied for PM-3, and DeployOpen does not publish prices, so use the drivers and quote questions to compare offers on a like-for-like basis.

Cost component	Who is paid or pulled in	One-time or recurring	What drives it up or down
Capital planning cycle work	Finance staff and security leads building investment requests for the security and privacy programs	Recurring each planning cycle	Number of investment requests, number of business units involved, and how well existing budget records are organized
Documenting the business case	Security and privacy officials preparing justification, and finance reviewing it	Recurring, with a larger first-time effort	Depth of the cases required by policy, and whether templates already exist for exhibits and business cases
Exception handling	Security and privacy owners who document and approve deviations from planned resourcing	Recurring, driven by events	Number of exceptions raised, and whether a defined approval path and register already exist
Documentation upkeep	Program staff who keep required documents current as laws and policies change	Recurring	Frequency of policy change, the number of documents in scope, and whether they are version controlled
Making planned resources available	Finance and budget owners releasing funds to the programs on schedule	Recurring per budget period	Approval chain length and whether spending authority is tied to the approved plan
Auditor sampling of budget records	Internal staff producing records for an independent assessor, plus the assessor's fees	Recurring per assessment cycle	Number of records sampled, how traceable the decisions are, and the assessment scope agreed in advance
Internal interview and evidence preparation	Staff with program planning responsibilities who answer assessor interviews	Recurring per assessment cycle	Number of personnel in scope and how current the planning records are
External review or implementation support	Independent assessor or an implementation partner preparing records, paid under a written scope	One-time for setup, recurring for periodic review	Fixed scope versus retainer, number of systems and programs covered, and the amount of existing documentation to rebuild

Who owns PM-3 and what can be outsourced

Your organization owns PM-3 in full. The control asks that resources for the security and privacy programs appear in capital planning and investment requests, that exceptions are documented, that required documentation is prepared as laws and policies demand, and that planned resources are actually made available for spending. Each of those outcomes depends on decisions taken by accountable people inside the organization, including budget owners, the senior information security official, the privacy official and finance leadership. No outside party can decide what the program receives or sign off on an exception on your behalf.

Funding decisions: Leadership decides which security and privacy needs enter capital planning and investment requests and how they are ranked against other demands.
Exception approvals: Named officials accept, reject or defer requests that fall outside the approved budget, and those decisions are recorded.
Release of resources: Finance releases planned amounts for expenditure, and the release date and amount are kept as records.
Policy and documentation ownership: Your leaders approve the documents that laws and internal policies require, such as program plans and resource statements.

Before you engage anyone, confirm which officials hold these authorities in your governance charter and whether the exception register has an owner.

Where PM-3 programs usually fall short

PM-3 is rarely missing outright. Organizations usually have some budget process and some documents, but the resourcing link between security, privacy and spend is weak. The four gaps below show where that link breaks and what closes each one.

Security absent from capital planning templates

Capital planning and investment requests often use templates built for infrastructure and product work, with no field for security or privacy needs. As a result, security work appears only after a project is funded, if at all. PM-3 expects the security and privacy program's resource needs to be included in these requests. Check that the template has a security and privacy section, that the program owner reviews each request, and that the assessment objects named in SP 800-53A, such as exhibit 300 and business cases, can be traced back to the program's stated needs.

Exceptions handled informally in email

When a team is allowed to skip a security or privacy requirement, the approval often lives in an inbox thread that nobody can find during an assessment. PM-3 requires exceptions to the resourcing picture to be documented. The closing action is a single exception register with the requirement, the business owner, the reason, the compensating measure, the approver and an expiry date. Ask the assessor which exceptions they would sample, then confirm each one can be produced in minutes rather than reconstructed from memory.

Documentation prepared but not maintained

Many programs produce the required plans, policies and reports once, for an audit or a contract, then let them drift. PM-3 expects the documentation that laws and policies require to be prepared, and an assessor will compare the dates and content against current operations. Assign each document an owner and a review trigger, such as a budget cycle, a major system change or a staffing change. Confirm the document version history shows the most recent review, not just the original approval.

Approved budgets never tied to spend

A budget can be approved in one fiscal year and quietly redirected by the time the funds are needed. PM-3 expects planned resources to be made available for expenditure, so an approval that never reaches the ledger does not meet the requirement. The closing action is a reconciliation between approved security and privacy line items and actual spend, reviewed by the program owner at a set interval. Ask finance for a report that shows planned, released and spent amounts for each line, and check how reallocations are approved.

Questions buyers ask about PM-3

How much effort does PM-3 take to meet?

PM-3 takes less effort in technical terms than most controls, but it depends on how mature your capital planning process already is. The control asks that security and privacy resource needs appear in capital planning and investment requests, that exceptions be documented, that required documentation be prepared, and that planned resources actually be available to spend. Most of the work is governance: getting security and privacy needs into the budget cycle, writing down the business cases and exhibits that the assessment examines, and showing that approved money reaches the programs. The cost of that work is mostly internal staff time. Effort rises if the organization has no defined capital planning process or if security and privacy spending is buried inside IT budgets. Ask your assessor which artifacts they expect to see before you plan the effort.

Do we need an outside partner to get PM-3 ready?

No, you do not need an outside partner for PM-3, because the control is about organizational budgeting and governance, which your leadership owns. A partner can help in narrower ways: reviewing how security and privacy requests flow into capital planning, drafting business case templates, organizing evidence so it is easy to examine, or preparing a readiness check before the assessment. DeployOpen plans, implements and documents self-hosted open-source platforms in your own infrastructure, so its role on PM-3 is limited to supporting technical evidence where a platform is involved. Only an independent assessor can test the control and report on it. Confirm the scope of any help in a written statement of work before work begins.

What does PM-3 require from finance and security staff?

PM-3 needs both groups to work from the same plan. Security and privacy leaders must identify their resource needs, such as staff, tooling, testing and training, and express them in terms finance can evaluate. Finance must include those needs in capital planning and investment requests and must make the approved amounts available for expenditure. In practice, the security team usually prepares business cases and exhibits, while finance confirms how requests are scored, approved and released. Both teams should document exceptions, meaning cases where a request was declined, deferred or funded differently than proposed, along with the reasons. The assessor will interview people with information security and privacy program planning responsibilities and will test the capital planning process itself.

How long does preparing for PM-3 take?

No duration is supplied for PM-3 preparation, so no timeline can be stated here. The time depends on whether your organization already runs an annual or periodic capital planning cycle that includes security and privacy requests. If it does, preparation may mostly involve documenting how that cycle works and assembling past business cases. If it does not, the work may need to start with defining the process and getting it approved. Confirm the expected evidence and its timing with your assessor, and align the preparation with your internal budget calendar, since the control's evidence follows the budget decisions that already happen.

Does PM-3 apply to low or moderate impact systems?

PM-3 is not allocated to the low, moderate or high security control baselines in SP 800-53B. The Program Management controls are deployed across the organization, support the information security program and are independent of any system impact level. PM-3 does appear in the SP 800-53B privacy control baseline, which applies to systems regardless of impact level. That means a system handling PII may need PM-3 evidence even if its security impact level is low. If you are scoping a low or moderate system, check whether it processes PII and whether a privacy baseline applies, and confirm the applicable baseline with the authorizing official or your assessor.

What will a partner not do for PM-3?

A partner will not issue the assessment result. Only an independent assessor, auditor or authorizing official can determine whether PM-3 is satisfied and document that conclusion. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. The organization also keeps ownership of the budget decisions themselves. A partner cannot decide what security funding the organization approves, and cannot promise that a particular funding outcome will be accepted by an assessor. Ask any provider to describe in writing which parts of PM-3 they support and which remain with your organization and the assessor.

Can we use our existing budget documents as PM-3 evidence?

Often yes, if those documents show the security and privacy needs clearly. Exhibit-style capital planning submissions, investment requests and business cases are the kinds of artifacts an assessor may examine for PM-3. Review your existing documents to confirm they name security and privacy resource needs, show that those needs entered the planning process, record any exceptions and show whether the planned money was released. Gaps usually appear where security requests are folded into general IT budgets with no separate line or justification. Confirm with your assessor which documents they accept and whether they need dated approval records.

How DeployOpen prepares PM-3 evidence

PM-3 evidence is mostly documents and decisions that the organization owns: the funding requests, the exception decisions and the resource commitments. DeployOpen's role is to prepare the planning templates, registers and evidence packs that make those decisions traceable for an assessor, while the organization keeps authority over what gets funded.

Written scope before any work

Each PM-3 engagement starts with a written scope that names the programs covered, the systems and environments in scope, the deliverables and the dates agreed before work begins. Engagements are fixed-scope, so the organization can see what is included and what is excluded. Check that the scope states who signs off the resource decisions and who receives the evidence packs.

Capital planning templates

DeployOpen prepares templates that help the security and privacy programs state their resource needs in the same format used for capital planning and investment requests. The templates record the needs, the rationale and the owner of each request. Ask whether your finance office already has a required format, since the templates should be adapted to it rather than replace it.

Exception register

Where planned resources cannot be provided, PM-3 expects the exception to be documented. DeployOpen can set up an exception register with fields for the requested resource, the reason it is not funded, the accepted risk, the approver and the review date. The register is maintained by the client, and approvals come from the client's own officials.

Required documentation inventory

Laws and internal policies determine which documents must be prepared for the security and privacy programs. DeployOpen can build an inventory that lists each required document, the requirement that drives it, the owner and the last review date. The inventory helps an assessor trace each document to its source obligation.

Evidence packs for self-hosted tools

For a self-hosted open-source environment, DeployOpen assembles evidence packs that show where budget was allocated, which tools and staff were provisioned, and when resources became available for spending. Each pack records the source system, the export date and the responsible owner. Confirm with your auditor which artifacts they accept as proof of availability.

Assessment support and handover

During assessment, DeployOpen helps the client locate records, prepare walkthroughs for the people an assessor will interview, and answer questions about how the templates and registers were used. The assessment itself is run by an independent assessor, and DeployOpen does not issue findings or attestations. Ask for the handover format and the support period in the written scope.