---
tags:
  - Rev5
  - Controls
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Program Management (PM)

This page contains all **37** controls and control enhancements in the Program Management (PM) family from the vendored NIST SP 800-53 Revision 5 OSCAL catalog.

!!! info "Official NIST OSCAL source"
    - **Catalog version:** 5.2.0
    - **OSCAL version:** 1.2.2
    - **Catalog last modified:** May 11, 2026

## PM-01 (Information Security Program Plan) { #pm-01 }

!!! quote ""
    - **a.** Develop and disseminate an organization-wide information security program plan that:
        - **1.** Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
        - **2.** Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
        - **3.** Reflects the coordination among organizational entities responsible for information security; and
        - **4.** Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
    - **b.** Review and update the organization-wide information security program plan [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and
    - **c.** Protect the information security program plan from unauthorized disclosure and modification.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-1)

---

## PM-02 (Information Security Program Leadership Role) { #pm-02 }

!!! quote ""
    Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-2)

---

## PM-03 (Information Security and Privacy Resources) { #pm-03 }

!!! quote ""
    - **a.** Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
    - **b.** Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
    - **c.** Make available for expenditure, the planned information security and privacy resources.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-3)

---

## PM-04 (Plan of Action and Milestones Process) { #pm-04 }

!!! quote ""
    - **a.** Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:
        - **1.** Are developed and maintained;
        - **2.** Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
        - **3.** Are reported in accordance with established reporting requirements.
    - **b.** Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-4)

---

## PM-05 (System Inventory) { #pm-05 }

!!! quote ""
    Develop and update [Assignment: organization-defined frequency] an inventory of organizational systems.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-5)

---

## PM-05 (01) (Inventory of Personally Identifiable Information) { #pm-05-01 }

!!! quote ""
    Establish, maintain, and update [Assignment: organization-defined frequency] an inventory of all systems, applications, and projects that process personally identifiable information.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-5-1)

---

## PM-06 (Measures of Performance) { #pm-06 }

!!! quote ""
    Develop, monitor, and report on the results of information security and privacy measures of performance.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-6)

---

## PM-07 (Enterprise Architecture) { #pm-07 }

!!! quote ""
    Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-7)

---

## PM-07 (01) (Offloading) { #pm-07-01 }

!!! quote ""
    Offload [Assignment: organization-defined non-essential functions or services] to other systems, system components, or an external provider.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-7-1)

---

## PM-08 (Critical Infrastructure Plan) { #pm-08 }

!!! quote ""
    Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-8)

---

## PM-09 (Risk Management Strategy) { #pm-09 }

!!! quote ""
    - **a.** Develops a comprehensive strategy to manage:
        - **1.** Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
        - **2.** Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
    - **b.** Implement the risk management strategy consistently across the organization; and
    - **c.** Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-9)

---

## PM-10 (Authorization Process) { #pm-10 }

!!! quote ""
    - **a.** Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
    - **b.** Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
    - **c.** Integrate the authorization processes into an organization-wide risk management program.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-10)

---

## PM-11 (Mission and Business Process Definition) { #pm-11 }

!!! quote ""
    - **a.** Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
    - **b.** Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
    - **c.** Review and revise the mission and business processes [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-11)

---

## PM-12 (Insider Threat Program) { #pm-12 }

!!! quote ""
    Implement an insider threat program that includes a cross-discipline insider threat incident handling team.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-12)

---

## PM-13 (Security and Privacy Workforce) { #pm-13 }

!!! quote ""
    Establish a security and privacy workforce development and improvement program.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-13)

---

## PM-14 (Testing, Training, and Monitoring) { #pm-14 }

!!! quote ""
    - **a.** Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:
        - **1.** Are developed and maintained; and
        - **2.** Continue to be executed; and
    - **b.** Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-14)

---

## PM-15 (Security and Privacy Groups and Associations) { #pm-15 }

!!! quote ""
    Establish and institutionalize contact with selected groups and associations within the security and privacy communities:
    
    - **a.** To facilitate ongoing security and privacy education and training for organizational personnel;
    - **b.** To maintain currency with recommended security and privacy practices, techniques, and technologies; and
    - **c.** To share current security and privacy information, including threats, vulnerabilities, and incidents.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-15)

---

## PM-16 (Threat Awareness Program) { #pm-16 }

!!! quote ""
    Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-16)

---

## PM-16 (01) (Automated Means for Sharing Threat Intelligence) { #pm-16-01 }

!!! quote ""
    Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-16-1)

---

## PM-17 (Protecting Controlled Unclassified Information on External Systems) { #pm-17 }

!!! quote ""
    - **a.** Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
    - **b.** Review and update the policy and procedures [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-17)

---

## PM-18 (Privacy Program Plan) { #pm-18 }

!!! quote ""
    - **a.** Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
        - **1.** Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
        - **2.** Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
        - **3.** Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
        - **4.** Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
        - **5.** Reflects coordination among organizational entities responsible for the different aspects of privacy; and
        - **6.** Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and
    - **b.** Update the plan [Assignment: organization-defined frequency] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-18)

---

## PM-19 (Privacy Program Leadership Role) { #pm-19 }

!!! quote ""
    Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-19)

---

## PM-20 (Dissemination of Privacy Program Information) { #pm-20 }

!!! quote ""
    Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:
    
    - **a.** Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;
    - **b.** Ensures that organizational privacy practices and reports are publicly available; and
    - **c.** Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-20)

---

## PM-20 (01) (Privacy Policies on Websites, Applications, and Digital Services) { #pm-20-01 }

!!! quote ""
    Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:
    
    - **(a)** Are written in plain language and organized in a way that is easy to understand and navigate;
    - **(b)** Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and
    - **(c)** Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-20-1)

---

## PM-21 (Accounting of Disclosures) { #pm-21 }

!!! quote ""
    - **a.** Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:
        - **1.** Date, nature, and purpose of each disclosure; and
        - **2.** Name and address, or other contact information of the individual or organization to which the disclosure was made;
    - **b.** Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and
    - **c.** Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-21)

---

## PM-22 (Personally Identifiable Information Quality Management) { #pm-22 }

!!! quote ""
    Develop and document organization-wide policies and procedures for:
    
    - **a.** Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
    - **b.** Correcting or deleting inaccurate or outdated personally identifiable information;
    - **c.** Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
    - **d.** Appeals of adverse decisions on correction or deletion requests.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-22)

---

## PM-23 (Data Governance Body) { #pm-23 }

!!! quote ""
    Establish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-23)

---

## PM-24 (Data Integrity Board) { #pm-24 }

!!! quote ""
    Establish a Data Integrity Board to:
    
    - **a.** Review proposals to conduct or participate in a matching program; and
    - **b.** Conduct an annual review of all matching programs in which the agency has participated.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-24)

---

## PM-25 (Minimization of Personally Identifiable Information Used in Testing, Training, and Research) { #pm-25 }

!!! quote ""
    - **a.** Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;
    - **b.** Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;
    - **c.** Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and
    - **d.** Review and update policies and procedures [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-25)

---

## PM-26 (Complaint Management) { #pm-26 }

!!! quote ""
    Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:
    
    - **a.** Mechanisms that are easy to use and readily accessible by the public;
    - **b.** All information necessary for successfully filing complaints;
    - **c.** Tracking mechanisms to ensure all complaints received are reviewed and addressed within [Assignment: organization-defined time period];
    - **d.** Acknowledgement of receipt of complaints, concerns, or questions from individuals within [Assignment: organization-defined time period]; and
    - **e.** Response to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-26)

---

## PM-27 (Privacy Reporting) { #pm-27 }

!!! quote ""
    - **a.** Develop [Assignment: organization-defined privacy reports] and disseminate to:
        - **1.** [Assignment: organization-defined oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and
        - **2.** [Assignment: organization-defined officials] and other personnel with responsibility for monitoring privacy program compliance; and
    - **b.** Review and update privacy reports [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-27)

---

## PM-28 (Risk Framing) { #pm-28 }

!!! quote ""
    - **a.** Identify and document:
        - **1.** Assumptions affecting risk assessments, risk responses, and risk monitoring;
        - **2.** Constraints affecting risk assessments, risk responses, and risk monitoring;
        - **3.** Priorities and trade-offs considered by the organization for managing risk; and
        - **4.** Organizational risk tolerance;
    - **b.** Distribute the results of risk framing activities to [Assignment: organization-defined personnel]; and
    - **c.** Review and update risk framing considerations [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-28)

---

## PM-29 (Risk Management Program Leadership Roles) { #pm-29 }

!!! quote ""
    - **a.** Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
    - **b.** Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-29)

---

## PM-30 (Supply Chain Risk Management Strategy) { #pm-30 }

!!! quote ""
    - **a.** Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;
    - **b.** Implement the supply chain risk management strategy consistently across the organization; and
    - **c.** Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational changes.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-30)

---

## PM-30 (01) (Suppliers of Critical or Mission-essential Items) { #pm-30-01 }

!!! quote ""
    Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-30-1)

---

## PM-31 (Continuous Monitoring Strategy) { #pm-31 }

!!! quote ""
    Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:
    
    - **a.** Establishing the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics];
    - **b.** Establishing [Assignment: organization-defined monitoring frequencies] and [Assignment: organization-defined assessment frequencies] for control effectiveness;
    - **c.** Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;
    - **d.** Correlation and analysis of information generated by control assessments and monitoring;
    - **e.** Response actions to address results of the analysis of control assessment and monitoring information; and
    - **f.** Reporting the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-31)

---

## PM-32 (Purposing) { #pm-32 }

!!! quote ""
    Analyze [Assignment: organization-defined systems or system components] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pm-32)

---
