id: "PM-03" title: "Information Security and Privacy Resources" family: "PM" family_name: "Program Management" sort_id: "pm-03" priority: "P1" implementation_level: "organization"
Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
Make available for expenditure, the planned information security and privacy resources.
Guidance
Organizations consider establishing champions for information security and privacy and, as part of including the necessary resources, assign specialized expertise and resources as needed. Organizations may designate and empower an Investment Review Board or similar group to manage and provide oversight for the information security and privacy aspects of the capital planning and investment control process.
Assessment Objective: the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented;
Assessment Objective: the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented;
Assessment Objective: the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
Assessment Objective: the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
Assessment Objective: information security resources are made available for expenditure as planned;
Assessment Objective: privacy resources are made available for expenditure as planned.
Information security program plan
Exhibit 300
Exhibit 53
business cases for capital planning and investment
procedures for capital planning and investment
documentation of exceptions to capital planning requirements
other relevant documents or records
Organizational personnel with information security program planning responsibilities
organizational personnel with privacy program planning responsibilities
organizational personnel responsible for capital planning and investment
organizational personnel with information security responsibilities
organizational personnel with privacy responsibilities
Organizational processes for capital planning and investment
organizational processes for business case, Exhibit 300, and Exhibit 53 development
mechanisms supporting the capital planning and investment process