# PM-07 Enterprise Architecture

NIST SP 800-53 control. Family: PM Program Management. Function: preventative. Baselines: privacy. Mapping licence: CC BY-SA 4.0.

Statement: Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.
Guidance: The integration of security and privacy requirements and controls into the enterprise architecture helps to ensure that security and privacy considerations are addressed throughout the system development life cycle and are explicitly related to the organization’s mission and business processes. The process of security and privacy requirements integration also embeds into the enterprise architecture and the organization’s security and privacy architectures consistent with the organizational risk management strategy. For PM-7, security and privacy architectures are developed at a system-of-systems level, representing all organizational systems. For PL-8, the security and privacy architectures are developed at a level that represents an individual system. The system-level architectures are consistent with the security and privacy architectures defined for the organization. Security and privacy requirements and control integration are most effectively accomplished through the rigorous application of the Risk Management Framework [SP 800-37] and supporting security standards and guidelines.

## Enhancements (1)
- PM-07(01) Offloading
Each enhancement's statement: /api/v1/controls/PM-07?fields=enhancements

## Patterns that use it (1)
- Important (1): SP-052 Decentralised Identity & Verifiable Credentials (draft)

## Clauses by framework (29 frameworks)
- iso_27001_2022: 4.3, A.5.8. OSA's own, not in NIST's crosswalk: 4.3, A.5.8
- iso_27002_2022: 5.8
- cobit_2019: APO02, APO03, APO05, BAI01, BAI11
- nist_csf_2: GV.OC-01, ID.AM-03, ID.AM-05. OSA's own, not in NIST's crosswalk: GV.OC-01, ID.AM-05
- mas_trm: 5
- bio2: 5.8
- rbi_csf: ITGRCA.4, ITGRCA.12
- lgpd_bcb: BCB.Art.3-Supp
- hkma_tme1: TME1.2.2, TME1.3.1, TME1.5.3
- dnb_good_practice: DNB.2.1
- cra: CRA.I.1
- cbb_tm: TM-2
- nca_ecc: 1-1, 1-6
- qatar_nia: GV
- sama_csf: 1.4
- uae_ia: T1
- bom_ctrm: 1.3, 3.7
- bcbs_239: Principle 2, Principle 6
- bot_cyber: Ch6.2
- sebi_cscrf: GV.OC
- nerc_cip: CIP-002-7
- nrc_73_54: 73.54(a)
- common_criteria: CC Part 1 — PP
- isae_3402: Clause 9
- fca_sysc_13: SYSC 13.4
- fda_cyber: SPDF-1
- hitrust_csf: 00.a
- basel_sco60: SCO60.2
- sec_custody_digital: SEC-CD-14
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PM-07
- Clauses only: /api/v1/controls/PM-07?fields=mappings
- Page for people: /controls/pm-07/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.