{"data":{"id":"PM-09","name":"Risk Management Strategy","family":"PM","family_name":"Program Management","withdrawn":false,"description":"a. Develops a comprehensive strategy to manage:\n1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and\n2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;\nb. Implement the risk management strategy consistently across the organization; and\nc. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.","supplemental_guidance":"An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in PM-30 can also provide useful inputs to the organization-wide risk management strategy.","enhancements":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"PM-09","name":"Risk Management Strategy","description":"a. Develops a comprehensive strategy to manage:\n1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and\n2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;\nb. Implement the risk management strategy consistently across the organization; and\nc. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.","discussion":"An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in PM-30 can also provide useful inputs to the organization-wide risk management strategy.","related_controls":["AC-01","AT-01","AU-01","CA-01","CA-02","CA-05","CA-06","CA-07","CM-01","CP-01","IA-01","IR-01","MA-01","MP-01","PE-01","PL-01","PL-02","PM-02","PM-08","PM-18","PM-28","PM-30","PS-01","PT-01","PT-02","PT-03","RA-01","RA-03","RA-09","SA-01","SA-04","SC-01","SC-38","SI-01","SI-12","SR-01","SR-02"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":true,"new_in_rev5":false,"changes_from_rev4":"Privacy risk added. Review and update frequency added as assignment parameter."}},"compliance_mappings":{"iso_27001_2022":["4.3","4.4","6.1","6.1.3","6.2","7.5","10.1"],"iso_27002_2022":[],"cobit_2019":["APO12","APO13","EDM01","EDM03"],"pci_dss_v4":["12.3"],"nist_csf_2":["DE.AE-04","GV.OC-02","GV.OV-01","GV.OV-02","GV.PO-01","GV.RM-01","GV.RM-02","GV.RM-03","GV.RM-04","GV.RM-05","GV.RM-06","GV.RM-07","GV.SC-03","GV.SC-09","ID.RA-04","ID.RA-05","ID.RA-06","ID.RA-07","PR.IR-04","RC.RP-04"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":["2-1 4.2","2-1 4.4"],"asd_e8":[],"nis2":["Art. 21(2)(a)"],"apra_cps_234":["Para 15"],"mas_trm":["3","4"],"pra_op_resilience":["PS6/21-2.1","SS1/21-3.2","SS1/21-4.1","SS1/21-10.1","SS2/21-3.1","SS2/21-4.1","SS2/21-9.1","SS2/21-12.1"],"bsi_grundschutz":["ISMS.1"],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":[],"rbi_csf":["ITGRCA.22","ITGRCA.25"],"fisc":["FISC.O1"],"lgpd_bcb":["BCB.Art.2","BCB.Art.3-Supp","BCB.Art.17","LGPD.Art.50","LGPD.BCB.Integration"],"hkma_tme1":["TME1.2.1","TME1.2.3","TME1.7.1"],"mlps_2":[],"dnb_good_practice":["DNB.1.1","DNB.4.1","DNB.4.2","DNB.4.3"],"cra":["CRA.Info.5"],"swift_cscf":[],"cbb_tm":["TM-1","TM-2","TM-3","TM-4"],"cbuae":["CR-1","CR-2"],"nca_ecc":["1-1","1-2","1-5"],"qatar_nia":["GV","RM"],"sama_csf":["1.1","1.2","1.3","1.8","2.2"],"uae_ia":["T1","T2"],"bog_cisd":["CISD-I","CISD-II","CISD-III","CISD-ISMS","CISD-XIII"],"bom_ctrm":["1.1","1.4","2.1","3.10"],"cbe_csf":["CRM-1","GOV-1"],"cbn_csf":["Part1.1","Part2.1","Part2.2"],"popia":["s8","s19"],"sa_js2":["JS2-4","JS2-5","JS2-6.2"],"bcbs_239":["Principle 1","Principle 5","Principle 8","Principle 9","Principle 12","Principle 13"],"bot_cyber":["Ch1.1","Ch1.2"],"cpmi_pfmi":["PFMI.P3","PFMI.P15","PFMI.P17"],"eba_ict":["3.3.3","3.4.1","3.7.1"],"ecb_croe":["CROE.2.1.1","CROE.2.2.1"],"ffiec_is":["II.A","II.B"],"hipaa_sr":["§164.308(a)(1)(i)","§164.308(a)(1)(ii)(A)","§164.308(a)(1)(ii)(B)","§164.316(a)"],"iosco_cyber":["GOV-2","GOV-3","PFMI-2","PFMI-3"],"nydfs_500":["500.2","500.3","500.9"],"sebi_cscrf":["CCMP","CYBER-INS","GV.OC","GV.PO","GV.RM"],"cmmc_2":["RA"],"nerc_cip":["CIP-003-9"],"nrc_73_54":["73.54(b)"],"tsa_psd":["SD-2 Sec E"],"ieee_1686":[],"ferc_cip":["Order 706","Order 893"],"doe_c2m2":["PROGRAM","RISK"],"api_1164":["Sec 4"],"awia":["AWWA Sec 1","Sec 2013(a)"],"iaea_nss":["Sec 3","Sec 4"],"pci_pts":[],"fips_140":[],"cbest":["CBEST.1"],"tiber_eu":["TIBER.CONF","TIBER.PREP"],"pci_hsm":[],"common_criteria":[],"isae_3402":["Clause 1","Clause 2","Clause 3","Clause 8"],"fca_sysc_13":["SYSC 13.1-2","SYSC 13.3","SYSC 13.5.2","SYSC 13.8.4","SYSC 13.8.5","SYSC 13.G.2"],"fda_21_cfr_11":["§11.2"],"fda_cyber":["524B-4","CRA-2","CRA-3","SPDF-2","TM-3","TR-2","VR-1"],"hitrust_csf":["00.a","00.b","03.a","03.b","12.a"],"iso_27799":["H.1"],"lloyds_ms":["CRM.1","GOV.1","MS8.1","MS10.1","MS10.2"],"naic_ds":["4","4A"],"nhs_dspt":["NDG-5.2","NDG-9.1"],"pra_ss1_23":["P1.2","P2.1","P3.5","P5.1","P5.4"],"solvency_ii":["Art.44(2)","Art.45","DR.260","DR.266","DR.267","EIOPA-ICT-4.2"],"owasp_masvs_v2":[],"csa_ccm_v4":["GRC-02"],"csa_aicm":["CCC-08","GRC-02","GRC-09","GRC-10","GRC-11","GRC-14","MDS-13"],"ccss_v9":["1.02.5"],"mica":["Art.34(5)","Art.35(1)","Art.41(1)","Art.47(1)","Art.54(1)","Art.59(1)","Art.62(1)","Art.62(6)","Art.66(1)","Art.111(1)"],"basel_sco60":["SCO60.1","SCO60.3","SCO60.4","SCO60.5","SCO60.13","SCO60.50","SCO60.54","SCO60.60","SCO60.72","SCO60.83","SCO60.85"],"bssc":["GSP-01","GSP-02","GSP-10","NOS-01","TIS-01"],"sec_custody_digital":["SEC-CD-09","SEC-CD-10","SEC-CD-18"],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings extracted from framework-coverage data 2026-10-03: iso_27001_2022 10.1, 4.3, 4.4, 6.2, 7.5 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 DE.AE-04, GV.OC-02, GV.RM-05, GV.SC-09, ID.RA-04, PR.IR-04, RC.RP-04 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: privacy baseline added, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-018","SP-034","SP-035","SP-038","SP-042","SP-043","SP-045","SP-047","SP-051","SP-053","SP-054"]}}