Data Integrity Board

frameworkNIST SP 800-53 Rev 5.2 sectionPM Program Management csf 2.0GV.RR-01 GV.RR-02 topics— frameworks0 0 3

Official textEstablish a Data Integrity Board to:
a. Review proposals to conduct or participate in a matching program; and
b. Conduct an annual review of all matching programs in which the agency has participated.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of PM-24 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RR-01 GV.RR-02	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
ISO 27001	Clause 7.2 A.5.2 A.5.3 A.5.4	Competence; Information security roles and responsibilities…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
CIS v8.1	CIS 14.1 CIS 14.9	Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
SOC 2	CC1.2 CC1.3 CC1.5	Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
PCI DSS	12.1.3 1.1.2 2.1.2 3.1.2	Security roles and responsibilities defined; Roles for network security controls assigned…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping +12 more loosely related (not mappings) 4.1.2 Roles for protecting data in transit assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 5.1.2 Roles for malware protection assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF GV.RR-01: related, not a mapping …and 8 more in the downloads
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
HIPAA	§164.308(a)(2)	Assigned Security Responsibility	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
GDPR	Art.37(1)Art.39(1)	Designation of the data protection officer; Tasks of the data protection officer	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
NIS2	1.2	Roles, responsibilities and authorities	Loosely related	No mapping. Only shares CSF GV.RR-02: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(c)Art.5(3)Art.6(4)	Governance and organisation; Governance and organisation…	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
CPS 234	Para 13 Para 14	Board ultimately responsible for information security; Define information security roles and responsibilities	Loosely related	No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.