800-53 · PM Program Management
PM-3
Information Security and Privacy Resources
frameworkNIST SP 800-53 Rev 5.2
sectionPM Program Management
csf 2.0GV.RM-03 GV.RR-03 PR.IR-04
topics—
frameworks1 0 4
Official texta. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
b. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
c. Make available for expenditure, the planned information security and privacy resources.NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
c. Make available for expenditure, the planned information security and privacy resources.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-03GV.RR-03PR.IR-04 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes; Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies… | No mapping. Only shares CSF GV.RM-03, GV.RR-03, PR.IR-04: related, not a mapping | |
| ISO 27001 | Clause 5.1Clause 6.2Clause 7.1 | Leadership and commitment; Information security objectives and planning to achieve them… | Crosswalk | NIST SP 800-53 → ISO 27001 mapping5 loosely related (not mappings) |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC1.2CC1.3CC1.5CC3.1 | Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities… | No mapping. Only shares CSF GV.RR-03, GV.RM-03: related, not a mapping | |
| PCI DSS | 5.2.3.15.3.2.16.3.16.3.3 | Re-evaluation frequency set by targeted risk analysis; Scan frequency set by targeted risk analysis… | No mapping. Only shares CSF GV.RM-03: related, not a mapping+13 more loosely related (not mappings)7.2.5.1 System and application account access periodically reviewed Only shares CSF GV.RM-03: related, not a mapping 8.6.3 System account passwords protected and changed Only shares CSF GV.RM-03: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Only shares CSF GV.RM-03: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Only shares CSF GV.RM-03: related, not a mapping …and 9 more in the downloads | |
| CMMC | — | No requirement | No mapping in our data | No mapping in our data. |
| HIPAA | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i)§164.308(a)(1)(ii)(B) | Data Backup Plan; Disaster Recovery Plan… | No mapping. Only shares CSF PR.IR-04, GV.RM-03: related, not a mapping | |
| GDPR | Art.24(1)Art.32(2)Art.37(1)Art.39(1) | Responsibility of the controller; Security of processing… | No mapping. Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping | |
| NIS2 | 2.11.1 | Risk management framework; Policy on the security of network and information systems | No mapping. Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping | |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(a)Art.5(2)(c)Art.5(3)Art.6(1) | Governance and organisation; Governance and organisation… | No mapping. Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping+4 more loosely related (not mappings)Art.24(1) General requirements for the performance of digital operational resilience testing Only shares CSF GV.RM-03: related, not a mapping | |
| CPS 234 | Para 13Para 14Para 15Para 27 | Board ultimately responsible for information security; Define information security roles and responsibilities… | No mapping. Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping+1 more loosely related (not mappings)Para 31 Review the testing programme at least annually Only shares CSF GV.RM-03: related, not a mapping | |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.