# PM-09 Risk Management Strategy

NIST SP 800-53 control. Family: PM Program Management. Function: preventative. Baselines: privacy. Mapping licence: CC BY-SA 4.0.

Statement: a. Develops a comprehensive strategy to manage: 1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and 2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information; b. Implement the risk management strategy consistently across the organization; and c. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.
Guidance: An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in PM-30 can also provide useful inputs to the organization-wide risk management strategy.

## Patterns that use it (11)
- Critical (4): SP-018 Information Security Management System; SP-043 Security Metrics and Measurement; SP-045 AI Governance and Responsible AI; SP-054 CBDC and Digital Currency Infrastructure (draft)
- Important (5): SP-034 Cyber Resilience; SP-035 Offensive Security Testing; SP-038 Vulnerability Management and Patching; SP-042 Third Party Risk Management; SP-047 Secure Agentic AI Frameworks
- Standard (2): SP-051 Tokenised Asset Security Architecture (draft); SP-053 Zero-Knowledge Proof Architecture (draft)

## Clauses by framework (67 frameworks)
- iso_27001_2022: 4.3, 4.4, 6.1, 6.1.3, 6.2, 7.5, 10.1. OSA's own, not in NIST's crosswalk: 6.1.3
- cobit_2019: APO12, APO13, EDM01, EDM03
- pci_dss_v4: 12.3
- nist_csf_2: DE.AE-04, GV.OC-02, GV.OV-01, GV.OV-02, GV.PO-01, GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-04, GV.RM-05, GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09, ID.RA-04, ID.RA-05, ID.RA-06, ID.RA-07, PR.IR-04, RC.RP-04. OSA's own, not in NIST's crosswalk: GV.PO-01, ID.RA-05, ID.RA-07
- iec_62443: 2-1 4.2, 2-1 4.4
- nis2: Art. 21(2)(a)
- apra_cps_234: Para 15
- mas_trm: 3, 4
- pra_op_resilience: PS6/21-2.1, SS1/21-3.2, SS1/21-4.1, SS1/21-10.1, SS2/21-3.1, SS2/21-4.1, SS2/21-9.1, SS2/21-12.1
- bsi_grundschutz: ISMS.1
- rbi_csf: ITGRCA.22, ITGRCA.25
- fisc: FISC.O1
- lgpd_bcb: BCB.Art.2, BCB.Art.3-Supp, BCB.Art.17, LGPD.Art.50, LGPD.BCB.Integration
- hkma_tme1: TME1.2.1, TME1.2.3, TME1.7.1
- dnb_good_practice: DNB.1.1, DNB.4.1, DNB.4.2, DNB.4.3
- cra: CRA.Info.5
- cbb_tm: TM-1, TM-2, TM-3, TM-4
- cbuae: CR-1, CR-2
- nca_ecc: 1-1, 1-2, 1-5
- qatar_nia: GV, RM
- sama_csf: 1.1, 1.2, 1.3, 1.8, 2.2
- uae_ia: T1, T2
- bog_cisd: CISD-I, CISD-II, CISD-III, CISD-ISMS, CISD-XIII
- bom_ctrm: 1.1, 1.4, 2.1, 3.10
- cbe_csf: CRM-1, GOV-1
- cbn_csf: Part1.1, Part2.1, Part2.2
- popia: s8, s19
- sa_js2: JS2-4, JS2-5, JS2-6.2
- bcbs_239: Principle 1, Principle 5, Principle 8, Principle 9, Principle 12, Principle 13
- bot_cyber: Ch1.1, Ch1.2
- cpmi_pfmi: PFMI.P3, PFMI.P15, PFMI.P17
- eba_ict: 3.3.3, 3.4.1, 3.7.1
- ecb_croe: CROE.2.1.1, CROE.2.2.1
- ffiec_is: II.A, II.B
- hipaa_sr: §164.308(a)(1)(i), §164.308(a)(1)(ii)(A), §164.308(a)(1)(ii)(B), §164.316(a)
- iosco_cyber: GOV-2, GOV-3, PFMI-2, PFMI-3
- nydfs_500: 500.2, 500.3, 500.9
- sebi_cscrf: CCMP, CYBER-INS, GV.OC, GV.PO, GV.RM
- cmmc_2: RA
- nerc_cip: CIP-003-9
- nrc_73_54: 73.54(b)
- tsa_psd: SD-2 Sec E
- ferc_cip: Order 706, Order 893
- doe_c2m2: PROGRAM, RISK
- api_1164: Sec 4
- awia: AWWA Sec 1, Sec 2013(a)
- iaea_nss: Sec 3, Sec 4
- cbest: CBEST.1
- tiber_eu: TIBER.CONF, TIBER.PREP
- isae_3402: Clause 1, Clause 2, Clause 3, Clause 8
- fca_sysc_13: SYSC 13.1-2, SYSC 13.3, SYSC 13.5.2, SYSC 13.8.4, SYSC 13.8.5, SYSC 13.G.2
- fda_21_cfr_11: §11.2
- fda_cyber: 524B-4, CRA-2, CRA-3, SPDF-2, TM-3, TR-2, VR-1
- hitrust_csf: 00.a, 00.b, 03.a, 03.b, 12.a
- iso_27799: H.1
- lloyds_ms: CRM.1, GOV.1, MS8.1, MS10.1, MS10.2
- naic_ds: 4, 4A
- nhs_dspt: NDG-5.2, NDG-9.1
- pra_ss1_23: P1.2, P2.1, P3.5, P5.1, P5.4
- solvency_ii: Art.44(2), Art.45, DR.260, DR.266, DR.267, EIOPA-ICT-4.2
- csa_ccm_v4: GRC-02
- csa_aicm: CCC-08, GRC-02, GRC-09, GRC-10, GRC-11, GRC-14, MDS-13
- ccss_v9: 1.02.5
- mica: Art.34(5), Art.35(1), Art.41(1), Art.47(1), Art.54(1), Art.59(1), Art.62(1), Art.62(6), Art.66(1), Art.111(1)
- basel_sco60: SCO60.1, SCO60.3, SCO60.4, SCO60.5, SCO60.13, SCO60.50, SCO60.54, SCO60.60, SCO60.72, SCO60.83, SCO60.85
- bssc: GSP-01, GSP-02, GSP-10, NOS-01, TIS-01
- sec_custody_digital: SEC-CD-09, SEC-CD-10, SEC-CD-18
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PM-09
- Clauses only: /api/v1/controls/PM-09?fields=mappings
- Page for people: /controls/pm-09/