Information Security Program Leadership Role

frameworkNIST SP 800-53 Rev 5.2 sectionPM Program Management csf 2.0GV.RR-01 GV.RR-02 topicsRoles & Responsibilities frameworks5 4 3

Official textAppoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of PM-2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RR-01 GV.RR-02 GV.RR-03	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced…	Crosswalk	Same topic: Roles & Responsibilities
ISO 27001	A.5.2 A.5.4 Clause 5.1 Clause 5.3	Information security roles and responsibilities; Management responsibilities…	Crosswalk	Same topic: Roles & Responsibilities NIST SP 800-53 → ISO 27001 mapping 2 loosely related (not mappings) Clause 7.2 Competence Loosely related Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF GV.RR-02: related, not a mapping
CIS v8.1	CIS 14.1 CIS 14.9	Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
SOC 2	CC1.2 CC1.3 CC1.5	Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities…	Editorial	Same topic: Roles & Responsibilities (editorial pick)
PCI DSS	12.1.3 12.1.4	Security roles and responsibilities defined; Executive responsibility for information security assigned	Crosswalk	Same topic: Roles & Responsibilities 14 loosely related (not mappings) 1.1.2 Roles for network security controls assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 2.1.2 Roles for secure configuration assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 3.1.2 Roles for protecting stored account data assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 4.1.2 Roles for protecting data in transit assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 5.1.2 Roles for malware protection assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF GV.RR-01: related, not a mapping 7.1.2 Roles for access restriction assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping …and 6 more in the downloads
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
HIPAA	§164.308(a)(2)	Assigned Security Responsibility	Crosswalk	Same topic: Roles & Responsibilities
GDPR	Art.37(1)Art.39(1)	Designation of the data protection officer; Tasks of the data protection officer	Editorial	Same topic: Roles & Responsibilities (editorial pick)
NIS2	1.2	Roles, responsibilities and authorities	Crosswalk	Same topic: Roles & Responsibilities
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(c)Art.5(3)Art.6(4)	Governance and organisation; Governance and organisation…	Editorial	Same topic: Roles & Responsibilities (editorial pick)
CPS 234	Para 13 Para 14	Board ultimately responsible for information security; Define information security roles and responsibilities	Editorial	Same topic: Roles & Responsibilities (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.