{"data":{"id":"PM-03","name":"Information Security and Privacy Resources","family":"PM","family_name":"Program Management","withdrawn":false,"description":"a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;\nb. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and\nc. Make available for expenditure, the planned information security and privacy resources.","supplemental_guidance":"Organizations consider establishing champions for information security and privacy and, as part of including the necessary resources, assign specialized expertise and resources as needed. Organizations may designate and empower an Investment Review Board or similar group to manage and provide oversight for the information security and privacy aspects of the capital planning and investment control process.","enhancements":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"PM-03","name":"Information Security and Privacy Resources","description":"a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;\nb. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and\nc. Make available for expenditure, the planned information security and privacy resources.","discussion":"Organizations consider establishing champions for information security and privacy and, as part of including the necessary resources, assign specialized expertise and resources as needed. Organizations may designate and empower an Investment Review Board or similar group to manage and provide oversight for the information security and privacy aspects of the capital planning and investment control process.","related_controls":["PM-04","SA-02"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":true,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Information Security Resources' to 'Information Security and Privacy Resources'. Privacy added throughout."}},"compliance_mappings":{"iso_27001_2022":["4.4","5.1","6.2","7.1"],"iso_27002_2022":[],"cobit_2019":["APO01","APO06","APO13","EDM01","EDM02","EDM04"],"pci_dss_v4":[],"nist_csf_2":["GV.RM-03","GV.RR-03","PR.IR-04"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":["2-1 4.2"],"asd_e8":[],"nis2":[],"apra_cps_234":["Para 15","Para 19-20"],"mas_trm":["3"],"pra_op_resilience":[],"bsi_grundschutz":["ISMS.1"],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":[],"rbi_csf":["ITGRCA.4","ITGRCA.5"],"fisc":["FISC.O1"],"lgpd_bcb":[],"hkma_tme1":["TME1.2.1"],"mlps_2":[],"dnb_good_practice":["DNB.4.3","DNB.5.2"],"cra":[],"swift_cscf":[],"cbb_tm":["TM-1"],"cbuae":["CR-1"],"nca_ecc":["1-2"],"qatar_nia":["GV"],"sama_csf":["1.1"],"uae_ia":["T1"],"bog_cisd":["CISD-I","CISD-II","CISD-ISMS"],"bom_ctrm":["1.1"],"cbe_csf":["GOV-1"],"cbn_csf":["Part1.1"],"popia":["s8"],"sa_js2":["JS2-4"],"bcbs_239":["Principle 1"],"bot_cyber":["Ch1.1"],"cpmi_pfmi":["CG.GOV","PFMI.P2","PFMI.P15"],"eba_ict":["3.2.2","3.6.1"],"ecb_croe":["CROE.2.1.1"],"ffiec_is":["I.B","I.C"],"hipaa_sr":["§164.308(a)(1)(i)","§164.316(a)"],"nydfs_500":["500.2","500.4"],"nerc_cip":["CIP-003-9"],"nrc_73_54":["73.54(b)"],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["PROGRAM"],"api_1164":[],"awia":["AWWA Sec 1"],"iaea_nss":["Sec 3"],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["00.a","04.a"],"iso_27799":[],"lloyds_ms":[],"naic_ds":["4","4C"],"nhs_dspt":[],"pra_ss1_23":["P2.1"],"solvency_ii":["EIOPA-ICT-4.1"],"owasp_masvs_v2":[],"csa_ccm_v4":["GRC-05"],"csa_aicm":["GRC-05"],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings extracted from framework-coverage data 2026-10-03: iso_27001_2022 5.1 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 GV.RM-03, PR.IR-04 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: privacy baseline added, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-018"]}}