Data Governance Body

frameworkNIST SP 800-53 Rev 5.2 sectionPM Program Management csf 2.0GV.RR-01 GV.RR-02 ID.AM-08 topics— frameworks0 0 0

Official textEstablish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of PM-23 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RR-01 GV.RR-02 ID.AM-08	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02, ID.AM-08: related, not a mapping
ISO 27001	Clause 7.2 A.5.2 A.5.3 A.5.4	Competence; Information security roles and responsibilities…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping +10 more loosely related (not mappings) A.5.8 Information security in project management Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.11 Return of assets Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.12 Classification of information Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 14.1 CIS 14.9	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08, GV.RR-01, GV.RR-02: related, not a mapping +7 more loosely related (not mappings) CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 3 more in the downloads
SOC 2	CC1.2 CC1.3 CC1.5 CC6.1	Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02, ID.AM-08: related, not a mapping
PCI DSS	6.2.2 12.1.3 1.1.2 2.1.2	Developers trained in secure software development; Security roles and responsibilities defined…	Loosely related	No mapping. Only shares CSF GV.RR-01, ID.AM-08, GV.RR-02: related, not a mapping +20 more loosely related (not mappings) 3.1.2 Roles for protecting stored account data assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 4.1.2 Roles for protecting data in transit assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 5.1.2 Roles for malware protection assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping …and 16 more in the downloads
CMMC	CA.L2-3.12.4 MA.L2-3.7.1 MA.L2-3.7.3 SC.L2-3.13.2	System Security Plan; Perform Maintenance…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
HIPAA	§164.308(a)(2)§164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)	Assigned Security Responsibility; Risk Management…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02, ID.AM-08: related, not a mapping +11 more loosely related (not mappings) §164.310(a)(2)(iv) Maintenance Records Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
GDPR	Art.37(1)Art.39(1)Art.30(1)	Designation of the data protection officer; Tasks of the data protection officer…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02, ID.AM-08: related, not a mapping
NIS2	1.2 6.2 12.4	Roles, responsibilities and authorities; Secure development life cycle…	Loosely related	No mapping. Only shares CSF GV.RR-02, ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.5(2)(c)Art.5(3)Art.6(4)Art.8(1)	Governance and organisation; Governance and organisation…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02, ID.AM-08: related, not a mapping +2 more loosely related (not mappings) Art.8(4) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping
CPS 234	Para 13 Para 14 Para 20	Board ultimately responsible for information security; Define information security roles and responsibilities…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02, ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.