| name | PM-23_data-governance-body |
| description | Establish a Data Governance Body consisting of [organization-defined] with [organization-defined]. |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","pm-23","pm"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | ["AT-2","AT-3","PM-19","PM-22","PM-24","PT-7","SI-4","SI-19"] |
| prerequisites | [] |
| severity_boost | {"AT-2":"Chain with AT-2 for comprehensive security coverage","AT-3":"Chain with AT-3 for comprehensive security coverage","PM-19":"Chain with PM-19 for comprehensive security coverage"} |
PM-23 Data Governance Body
High-Level Description
Family: Program Management (PM)
Framework: NIST SP 800-53 Rev 5
A Data Governance Body can help ensure that the organization has coherent policies and the ability to balance the utility of data with security and privacy requirements. The Data Governance Body establishes policies, procedures, and standards that facilitate data governance so that data, including personally identifiable information, is effectively managed and maintained in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidance. Responsibilities can include developing and implementing guidelines that support data modeling, quality, integrity, and the de-identification needs of personally identifiable information across the information life cycle as well as reviewing and approving applications to release data outside of the organization, archiving the applications and the released data, and performing post-release monitoring to ensure that the assumptions made as part of the data release continue to be valid. Members include the chief information officer, senior agency information security officer, and senior agency official for privacy. Federal agencies are required to establish a Data Governance Body with specific roles and responsibilities in accordance with the EVIDACT and policies set forth under OMB M-19-23.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for PM-23 implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| Manual Review |
