Privacy Program Plan

frameworkNIST SP 800-53 Rev 5.2 sectionPM Program Management csf 2.0DE.AE-04 GV.OC-02 GV.OV-01 GV.RM-06 GV.RM-07 GV.SC-03 ID.RA-06 topics— frameworks1 0 2

Official texta. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and
b. Update the plan [Assignment: organization-defined frequency] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of PM-18 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.AE-04 GV.OC-02 GV.OV-01 GV.RM-06	The estimated impact and scope of adverse events are understood; Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered…	Loosely related	No mapping. Only shares CSF DE.AE-04, GV.OC-02, GV.OV-01, GV.RM-06: related, not a mapping +3 more loosely related (not mappings) GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Loosely related Only shares CSF GV.RM-07: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated Loosely related Only shares CSF ID.RA-06: related, not a mapping
ISO 27001	A.5.34	Privacy and protection of PII	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 20 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.RM-06, GV.SC-03: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping Clause 8.1 Operational planning and control Loosely related Only shares CSF GV.OC-02, GV.SC-03: related, not a mapping A.5.5 Contact with authorities Loosely related Only shares CSF GV.OV-01: related, not a mapping A.5.6 Contact with special interest groups Loosely related Only shares CSF GV.OV-01: related, not a mapping A.5.7 Threat intelligence Loosely related Only shares CSF ID.RA-06: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.SC-03: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-03: related, not a mapping …and 12 more in the downloads
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC3.1 CC3.2 CC3.3 CC3.4	Objectives specified clearly enough to identify risks; Risk identification and analysis…	Loosely related	No mapping. Only shares CSF GV.RM-06, ID.RA-06: related, not a mapping +4 more loosely related (not mappings) CC5.1 Control activities that mitigate risks Loosely related Only shares CSF GV.RM-06: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.AE-04: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.RM-06: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03: related, not a mapping
PCI DSS	6.3.1 6.3.3 11.6.1 12.3.1	Vulnerabilities identified and risk-ranked; Security patches installed promptly…	Loosely related	No mapping. Only shares CSF GV.RM-06, GV.SC-03, ID.RA-06, GV.OV-01: related, not a mapping +35 more loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.RM-06, GV.SC-03: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-06, GV.SC-03: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF DE.AE-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.AE-04: related, not a mapping …and 31 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.OV-01, GV.RM-06, GV.RM-07…: related, not a mapping
HIPAA	§164.316(a)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)	Policies and Procedures; Risk Analysis…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.RM-06, GV.RM-07, GV.SC-03: related, not a mapping +21 more loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping …and 17 more in the downloads
GDPR	Art.24(1)Art.28(1)Art.32(2)Art.35(1)	Responsibility of the controller; Processor…	Loosely related	No mapping. Only shares CSF GV.RM-06, GV.SC-03, ID.RA-06: related, not a mapping +1 more loosely related (not mappings) Art.35(7) Data protection impact assessment Loosely related Only shares CSF ID.RA-06: related, not a mapping
NIS2	2.1 1.1 3.4 4.3	Risk management framework; Policy on the security of network and information systems…	Loosely related	No mapping. Only shares CSF GV.RM-06, ID.RA-06, GV.OC-02, DE.AE-04: related, not a mapping +2 more loosely related (not mappings) 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-06: related, not a mapping 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Loosely related Only shares CSF GV.RM-06: related, not a mapping
Essential Eight	ISM-1228	Cyber security events are analysed in a timely manner to identify cyber security incidents	Loosely related	No mapping. Only shares CSF DE.AE-04: related, not a mapping
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.RM-06, ID.RA-06: related, not a mapping +8 more loosely related (not mappings) Art.8(3) Identification Loosely related Only shares CSF ID.RA-06: related, not a mapping Art.8(7) Identification Loosely related Only shares CSF ID.RA-06: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.AE-04: related, not a mapping Art.16(1) Simplified ICT risk management framework Loosely related Only shares CSF GV.RM-06: related, not a mapping …and 4 more in the downloads
CPS 234	Para 13 Para 15 Para 16 Para 17	Board ultimately responsible for information security; Maintain a capability commensurate with threats…	Loosely related	No mapping. Only shares CSF GV.RM-06, GV.SC-03, ID.RA-06: related, not a mapping +4 more loosely related (not mappings) Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF ID.RA-06: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-06: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-06: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.