_nist/sp-800-53/pm/pm-01 · always-coding.co.uk

id: "PM-01" title: "Information Security Program Plan" family: "PM" family_name: "Program Management" sort_id: "pm-01" priority: "P1" implementation_level: "organization"

Develop and disseminate an organization-wide information security program plan that:

Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;

Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;

Reflects the coordination among organizational entities responsible for information security; and

Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;

Review and update the organization-wide information security program plan {{ insert: param, pm-01_odp.01 }} and following {{ insert: param, pm-01_odp.02 }} ; and

Protect the information security program plan from unauthorized disclosure and modification.

Guidance

An information security program plan is a formal document that provides an overview of the security requirements for an organization-wide information security program and describes the program management controls and common controls in place or planned for meeting those requirements. An information security program plan can be represented in a single document or compilations of documents. Privacy program plans and supply chain risk management plans are addressed separately in PM-18 and SR-2 , respectively.

An information security program plan documents implementation details about program management and common controls. The plan provides sufficient information about the controls (including specification of parameters for assignment and selection operations, explicitly or by reference) to enable implementations that are unambiguously compliant with the intent of the plan and a determination of the risk to be incurred if the plan is implemented as intended. Updates to information security program plans include organizational changes and problems identified during plan implementation or control assessments.

Program management controls may be implemented at the organization level or the mission or business process level, and are essential for managing the organization’s information security program. Program management controls are distinct from common, system-specific, and hybrid controls because program management controls are independent of any particular system. Together, the individual system security plans and the organization-wide information security program plan provide complete coverage for the security controls employed within the organization.

Common controls available for inheritance by organizational systems are documented in an appendix to the organization’s information security program plan unless the controls are included in a separate security plan for a system. The organization-wide information security program plan indicates which separate security plans contain descriptions of common controls.

Events that may precipitate an update to the information security program plan include, but are not limited to, organization-wide assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines.

Assessment Objective: an organization-wide information security program plan is developed;

Assessment Objective: the information security program plan is disseminated;

Assessment Objective: the information security program plan provides an overview of the requirements for the security program;

Assessment Objective: the information security program plan provides a description of the security program management controls in place or planned for meeting those requirements;

Assessment Objective: the information security program plan provides a description of the common controls in place or planned for meeting those requirements;

Assessment Objective: the information security program plan includes the identification and assignment of roles;

Assessment Objective: the information security program plan includes the identification and assignment of responsibilities;

Assessment Objective: the information security program plan addresses management commitment;

Assessment Objective: the information security program plan addresses coordination among organizational entities;

Assessment Objective: the information security program plan addresses compliance;

Assessment Objective: the information security program plan reflects the coordination among the organizational entities responsible for information security;

Assessment Objective: the information security program plan is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;

Assessment Objective: the information security program plan is reviewed and updated {{ insert: param, pm-01_odp.01 }};

Assessment Objective: the information security program plan is reviewed and updated following {{ insert: param, pm-01_odp.02 }};

Assessment Objective: the information security program plan is protected from unauthorized disclosure;

Assessment Objective: the information security program plan is protected from unauthorized modification.

Information security program plan

procedures addressing program plan development and implementation

procedures addressing program plan reviews and updates

procedures addressing coordination of the program plan with relevant entities

procedures for program plan approvals

records of program plan reviews and updates