# PM-03 Information Security and Privacy Resources

NIST SP 800-53 control. Family: PM Program Management. Function: preventative. Baselines: privacy. Mapping licence: CC BY-SA 4.0.

Statement: a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; b. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and c. Make available for expenditure, the planned information security and privacy resources.
Guidance: Organizations consider establishing champions for information security and privacy and, as part of including the necessary resources, assign specialized expertise and resources as needed. Organizations may designate and empower an Investment Review Board or similar group to manage and provide oversight for the information security and privacy aspects of the capital planning and investment control process.

## Patterns that use it (1)
- Important (1): SP-018 Information Security Management System

## Clauses by framework (42 frameworks)
- iso_27001_2022: 4.4, 5.1, 6.2, 7.1. OSA's own, not in NIST's crosswalk: 4.4
- cobit_2019: APO01, APO06, APO13, EDM01, EDM02, EDM04
- nist_csf_2: GV.RM-03, GV.RR-03, PR.IR-04
- iec_62443: 2-1 4.2
- apra_cps_234: Para 15, Para 19-20
- mas_trm: 3
- bsi_grundschutz: ISMS.1
- rbi_csf: ITGRCA.4, ITGRCA.5
- fisc: FISC.O1
- hkma_tme1: TME1.2.1
- dnb_good_practice: DNB.4.3, DNB.5.2
- cbb_tm: TM-1
- cbuae: CR-1
- nca_ecc: 1-2
- qatar_nia: GV
- sama_csf: 1.1
- uae_ia: T1
- bog_cisd: CISD-I, CISD-II, CISD-ISMS
- bom_ctrm: 1.1
- cbe_csf: GOV-1
- cbn_csf: Part1.1
- popia: s8
- sa_js2: JS2-4
- bcbs_239: Principle 1
- bot_cyber: Ch1.1
- cpmi_pfmi: CG.GOV, PFMI.P2, PFMI.P15
- eba_ict: 3.2.2, 3.6.1
- ecb_croe: CROE.2.1.1
- ffiec_is: I.B, I.C
- hipaa_sr: §164.308(a)(1)(i), §164.316(a)
- nydfs_500: 500.2, 500.4
- nerc_cip: CIP-003-9
- nrc_73_54: 73.54(b)
- doe_c2m2: PROGRAM
- awia: AWWA Sec 1
- iaea_nss: Sec 3
- hitrust_csf: 00.a, 04.a
- naic_ds: 4, 4C
- pra_ss1_23: P2.1
- solvency_ii: EIOPA-ICT-4.1
- csa_ccm_v4: GRC-05
- csa_aicm: GRC-05
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PM-03
- Clauses only: /api/v1/controls/PM-03?fields=mappings
- Page for people: /controls/pm-03/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.