CyberStrikeus/CyberStrike - Page 131

pl-8-1-defense-in-depth

Design the security and privacy architectures for the system using a defense-in-depth approach that: Allocates [organization-defined] to [organization

pl-8-2-supplier-diversity

Require that [organization-defined] allocated to [organization-defined] are obtained from different suppliers.

pl-8-security-and-privacy-architectures

Develop security and privacy architectures for the system that: Describe the requirements and approach to be taken for protecting the confidentiality,

pl-9-central-management

Centrally manage [organization-defined].

pm-1-information-security-program-plan

Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program

pm-10-authorization-process

Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;

pm-11-mission-and-business-process-definition

Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organization...

pm-12-insider-threat-program

Implement an insider threat program that includes a cross-discipline insider threat incident handling team.

pm-13-security-and-privacy-workforce

Establish a security and privacy workforce development and improvement program.

pm-14-testing-training-and-monitoring

Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated

pm-15-security-and-privacy-groups-and-associations

Establish and institutionalize contact with selected groups and associations within the security and privacy communities: To facilitate ongoing securi

pm-16-1-automated-means-for-sharing-threat-intelligence

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

pm-16-threat-awareness-program

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

pm-18-privacy-program-plan

Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and: Includes a descripti

pm-19-privacy-program-leadership-role

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applica

pm-2-information-security-program-leadership-role

Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wi

pm-20-dissemination-of-privacy-program-information

Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organizati

pm-21-accounting-of-disclosures

Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: Date, nature, and purpose of each disclo

pm-22-personally-identifiable-information-quality-management

Develop and document organization-wide policies and procedures for: Reviewing for the accuracy, relevance, timeliness, and completeness of personally

pm-23-data-governance-body

Establish a Data Governance Body consisting of [organization-defined] with [organization-defined].

pm-24-data-integrity-board

Establish a Data Integrity Board to: Review proposals to conduct or participate in a matching program; and Conduct an annual review of all matching pr

pm-26-complaint-management

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy

pm-27-privacy-reporting

Develop [organization-defined] and disseminate to: [organization-defined] to demonstrate accountability with statutory, regulatory, and policy privacy

pm-28-risk-framing

Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk respo

pm-29-risk-management-program-leadership-roles

Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strate...

pm-3-information-security-and-privacy-resources

Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document al...

pm-30-1-suppliers-of-critical-or-mission-essential-items

Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.

pm-30-supply-chain-risk-management-strategy

Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of sy...

pm-31-continuous-monitoring-strategy

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following orga

pm-32-purposing

Analyze [organization-defined] supporting mission essential services or functions to ensure that the information resources are being used consistent w

pm-4-plan-of-action-and-milestones-process

Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and

pm-5-1-inventory-of-personally-identifiable-information

Establish, maintain, and update [organization-defined] an inventory of all systems, applications, and projects that process personally identifiable in

pm-5-system-inventory

Develop and update [organization-defined] an inventory of organizational systems.

pm-6-measures-of-performance

Develop, monitor, and report on the results of information security and privacy measures of performance.

pm-7-1-offloading

Offload [organization-defined] to other systems, system components, or an external provider.

pm-7-enterprise-architecture

Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operati

pm-8-critical-infrastructure-plan

Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protect

pm-9-risk-management-strategy

Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation a

ps-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] personnel security policy that: Procedures to facilitate the impl

ps-2-position-risk-designation

Assign a risk designation to all organizational positions;