ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
PM > PM-7 > PM-7(1)

PM-7(1) Enterprise Architecture | Offloading
Family: Program Management (PM) > PM-7 Enterprise Architecture

Offload [Assignment: organization-defined non-essential functions or services] to other systems, system components, or an external provider.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-8

PM-8 Critical Infrastructure Plan
Family: Program Management (PM)

Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-8 > Discussion

PM-8 Critical Infrastructure Plan - Discussion
Family: Program Management (PM)

Protection strategies are based on the prioritization of critical assets and resources. The requirement and guidance for defining critical infrastructure and key resources and for preparing an associated critical infrastructure protection plan are found in applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-9

PM-9 Risk Management Strategy
Family: Program Management (PM)

a. Develops a comprehensive strategy to manage:
1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
b. Implement the risk management strategy consistently across the organization; and
c. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-9 > Discussion

PM-9 Risk Management Strategy - Discussion
Family: Program Management (PM)

An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization's risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in [PM-30](#pm-30) can also provide useful inputs to the organization-wide risk management strategy.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-10

PM-10 Authorization Process
Family: Program Management (PM)

a. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
b. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
c. Integrate the authorization processes into an organization-wide risk management program.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-10 > Discussion

PM-10 Authorization Process - Discussion
Family: Program Management (PM)

Authorization processes for organizational systems and environments of operation require the implementation of an organization-wide risk management process and associated security and privacy standards and guidelines. Specific roles for risk management processes include a risk executive (function) and designated authorizing officials for each organizational system and common control provider. The authorization processes for the organization are integrated with continuous monitoring processes to facilitate ongoing understanding and acceptance of security and privacy risks to organizational operations, organizational assets, individuals, other organizations, and the Nation.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-11

PM-11 Mission and Business Process Definition
Family: Program Management (PM)

a. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
b. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
c. Review and revise the mission and business processes [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
PM > PM-11 > Discussion

PM-11 Mission and Business Process Definition - Discussion
Family: Program Management (PM)

Protection needs are technology-independent capabilities that are required to counter threats to organizations, individuals, systems, and the Nation through the compromise of information (i.e., loss of confidentiality, integrity, availability, or privacy). Information protection and personally identifiable information processing needs are derived from the mission and business needs defined by organizational stakeholders, the mission and business processes designed to meet those needs, and the organizational risk management strategy. Information protection and personally identifiable information processing needs determine the required controls for the organization and the systems. Inherent to defining protection and personally identifiable information processing needs is an understanding of the adverse impact that could result if a compromise or breach of information occurs. The categorization process is used to make such potential impact determinations. Privacy risks to individuals can arise from the compromise of personally identifiable information, but they can also arise as unintended consequences or a byproduct of the processing of personally identifiable information at any stage of the information life cycle. Privacy risk assessments are used to prioritize the risks that are created for individuals from system processing of personally identifiable information. These risk assessments enable the selection of the required privacy controls for the organization and systems. Mission and business process definitions and the associated protection requirements are documented in accordance with organizational policies and procedures.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-12

PM-12 Insider Threat Program
Family: Program Management (PM)

Implement an insider threat program that includes a cross-discipline insider threat incident handling team.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-12 > Discussion

PM-12 Insider Threat Program - Discussion
Family: Program Management (PM)

Organizations that handle classified information are required, under Executive Order 13587 [EO 13587](#0af071a6-cf8e-48ee-8c82-fe91efa20f94) and the National Insider Threat Policy [ODNI NITP](#06d74ea9-2178-449c-a9c5-b2980f804ac8) , to establish insider threat programs. The same standards and guidelines that apply to insider threat programs in classified environments can also be employed effectively to improve the security of controlled unclassified and other information in non-national security systems. Insider threat programs include controls to detect and prevent malicious insider activity through the centralized integration and analysis of both technical and nontechnical information to identify potential insider threat concerns. A senior official is designated by the department or agency head as the responsible individual to implement and provide oversight for the program. In addition to the centralized integration and analysis capability, insider threat programs require organizations to prepare department or agency insider threat policies and implementation plans, conduct host-based user monitoring of individual employee activities on government-owned classified computers, provide insider threat awareness training to employees, receive access to information from offices in the department or agency for insider threat analysis, and conduct self-assessments of department or agency insider threat posture.

Insider threat programs can leverage the existence of incident handling teams that organizations may already have in place, such as computer security incident response teams. Human resources records are especially important in this effort, as there is compelling evidence to show that some types of insider crimes are often preceded by nontechnical behaviors in the workplace, including ongoing patterns of disgruntled behavior and conflicts with coworkers and other colleagues. These precursors can guide organizational officials in more focused, targeted monitoring efforts. However, the use of human resource records could raise significant concerns for privacy. The participation of a legal team, including consultation with the senior agency official for privacy, ensures that monitoring activities are performed in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-13

PM-13 Security and Privacy Workforce
Family: Program Management (PM)

Establish a security and privacy workforce development and improvement program.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-13 > Discussion

PM-13 Security and Privacy Workforce - Discussion
Family: Program Management (PM)

Security and privacy workforce development and improvement programs include defining the knowledge, skills, and abilities needed to perform security and privacy duties and tasks; developing role-based training programs for individuals assigned security and privacy roles and responsibilities; and providing standards and guidelines for measuring and building individual qualifications for incumbents and applicants for security- and privacy-related positions. Such workforce development and improvement programs can also include security and privacy career paths to encourage security and privacy professionals to advance in the field and fill positions with greater responsibility. The programs encourage organizations to fill security- and privacy-related positions with qualified personnel. Security and privacy workforce development and improvement programs are complementary to organizational security awareness and training programs and focus on developing and institutionalizing the core security and privacy capabilities of personnel needed to protect organizational operations, assets, and individuals.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-14

PM-14 Testing, Training, and Monitoring
Family: Program Management (PM)

a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:
1. Are developed and maintained; and
2. Continue to be executed; and
b. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-14 > Discussion

PM-14 Testing, Training, and Monitoring - Discussion
Family: Program Management (PM)

A process for organization-wide security and privacy testing, training, and monitoring helps ensure that organizations provide oversight for testing, training, and monitoring activities and that those activities are coordinated. With the growing importance of continuous monitoring programs, the implementation of information security and privacy across the three levels of the risk management hierarchy and the widespread use of common controls, organizations coordinate and consolidate the testing and monitoring activities that are routinely conducted as part of ongoing assessments supporting a variety of controls. Security and privacy training activities, while focused on individual systems and specific roles, require coordination across all organizational elements. Testing, training, and monitoring plans and activities are informed by current threat and vulnerability assessments.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-15

PM-15 Security and Privacy Groups and Associations
Family: Program Management (PM)

Establish and institutionalize contact with selected groups and associations within the security and privacy communities:
a. To facilitate ongoing security and privacy education and training for organizational personnel;
b. To maintain currency with recommended security and privacy practices, techniques, and technologies; and
c. To share current security and privacy information, including threats, vulnerabilities, and incidents.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-15 > Discussion

PM-15 Security and Privacy Groups and Associations - Discussion
Family: Program Management (PM)

Ongoing contact with security and privacy groups and associations is important in an environment of rapidly changing technologies and threats. Groups and associations include special interest groups, professional associations, forums, news groups, users' groups, and peer groups of security and privacy professionals in similar organizations. Organizations select security and privacy groups and associations based on mission and business functions. Organizations share threat, vulnerability, and incident information as well as contextual insights, compliance techniques, and privacy problems consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-16

PM-16 Threat Awareness Program
Family: Program Management (PM)

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-16 > Discussion

PM-16 Threat Awareness Program - Discussion
Family: Program Management (PM)

Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-16 > PM-16(1) > Discussion

PM-16(1) Automated Means for Sharing Threat Intelligence - Discussion
Family: Program Management (PM) > PM-16 Threat Awareness Program

To maximize the effectiveness of monitoring, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-16 > PM-16(1)

PM-16(1) Threat Awareness Program | Automated Means for Sharing Threat Intelligence
Family: Program Management (PM) > PM-16 Threat Awareness Program

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-17

PM-17 Protecting Controlled Unclassified Information on External Systems
Family: Program Management (PM)

a. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
b. Review and update the policy and procedures [Assignment: organization-defined organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
PM > PM-17 > Discussion

PM-17 Protecting Controlled Unclassified Information on External Systems - Discussion
Family: Program Management (PM)

Controlled unclassified information is defined by the National Archives and Records Administration along with the safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) and, specifically for systems external to the federal organization, [32 CFR 2002.14h](https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/xml/CFR-2017-title32-vol6-part2002.xml) . The policy prescribes the specific use and conditions to be implemented in accordance with organizational procedures, including via its contracting processes.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-18

PM-18 Privacy Program Plan
Family: Program Management (PM)

a. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program, and:
1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and
b. Update the plan [Assignment: organization-defined frequency] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-18 > Discussion

PM-18 Privacy Program Plan - Discussion
Family: Program Management (PM)

A privacy program plan is a formal document that provides an overview of an organization's privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the senior agency official for privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. Privacy program plans can be represented in single documents or compilations of documents.

The senior agency official for privacy is responsible for designating which privacy controls the organization will treat as program management, common, system-specific, and hybrid controls. Privacy program plans provide sufficient information about the privacy program management and common controls (including the specification of parameters and assignment and selection operations explicitly or by reference) to enable control implementations that are unambiguously compliant with the intent of the plans and a determination of the risk incurred if the plans are implemented as intended.

Program management controls are generally implemented at the organization level and are essential for managing the organization's privacy program. Program management controls are distinct from common, system-specific, and hybrid controls because program management controls are independent of any particular information system. Together, the privacy plans for individual systems and the organization-wide privacy program plan provide complete coverage for the privacy controls employed within the organization.

Common controls are documented in an appendix to the organization's privacy program plan unless the controls are included in a separate privacy plan for a system. The organization-wide privacy program plan indicates which separate privacy plans contain descriptions of privacy controls.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-19

PM-19 Privacy Program Leadership Role
Family: Program Management (PM)

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.
Security and Privacy Controls for Information Systems and Organizations
PM > PM-19 > Discussion

PM-19 Privacy Program Leadership Role - Discussion
Family: Program Management (PM)

The privacy officer is an organizational official. For federal agencies-as defined by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines-this official is designated as the senior agency official for privacy. Organizations may also refer to this official as the chief privacy officer. The senior agency official for privacy also has roles on the data management board (see [PM-23](#pm-23) ) and the data integrity board (see [PM-24](#pm-24)).
Security and Privacy Controls for Information Systems and Organizations
PM > PM-20

PM-20 Dissemination of Privacy Program Information
Family: Program Management (PM)

Maintain a central resource webpage on the organization's principal public website that serves as a central source of information about the organization's privacy program and that:
a. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;
b. Ensures that organizational privacy practices and reports are publicly available; and
c. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.