# PM-13 Security and Privacy Workforce

NIST SP 800-53 control. Family: PM Program Management. Function: preventative. Baselines: privacy. Mapping licence: CC BY-SA 4.0.

Statement: Establish a security and privacy workforce development and improvement program.
Guidance: Security and privacy workforce development and improvement programs include defining the knowledge, skills, and abilities needed to perform security and privacy duties and tasks; developing role-based training programs for individuals assigned security and privacy roles and responsibilities; and providing standards and guidelines for measuring and building individual qualifications for incumbents and applicants for security- and privacy-related positions. Such workforce development and improvement programs can also include security and privacy career paths to encourage security and privacy professionals to advance in the field and fill positions with greater responsibility. The programs encourage organizations to fill security- and privacy-related positions with qualified personnel. Security and privacy workforce development and improvement programs are complementary to organizational security awareness and training programs and focus on developing and institutionalizing the core security and privacy capabilities of personnel needed to protect organizational operations, assets, and individuals.

## Patterns that use it (2)
- Important (2): SP-018 Information Security Management System; SP-043 Security Metrics and Measurement

## Clauses by framework (48 frameworks)
- iso_27001_2022: 5.1, 7.2, 7.3, A.5.4, A.6.3. OSA's own, not in NIST's crosswalk: 5.1, 7.3, A.5.4
- iso_27002_2022: 5.4, 6.3
- cobit_2019: APO07, BAI08, EDM04
- nist_csf_2: GV.RR-01, GV.RR-02, GV.RR-03, GV.RR-04, PR.AT-01, PR.AT-02. OSA's own, not in NIST's crosswalk: GV.RR-01, GV.RR-03, PR.AT-01, PR.AT-02
- cis_controls_v8: CIS 14, CIS 14.1, CIS 14.9
- nis2: Art. 21(2)(g)
- apra_cps_234: Para 15, Para 19-20
- pra_op_resilience: SS1/21-5.1, SS2/21-17.1
- bsi_grundschutz: ORP.2, ORP.3
- bio2: 5.4, 6.3
- rbi_csf: ITGRCA.24
- lgpd_bcb: BCB.Art.4
- hkma_tme1: TME1.7.1
- mlps_2: 8.1.7.1
- dnb_good_practice: DNB.8.2, DNB.8.3, DNB.9.2
- cbb_tm: TM-3
- cbuae: CR-1, CR-11
- nca_ecc: 1-2, 1-4, 1-10
- qatar_nia: GV
- sama_csf: 1.6
- uae_ia: T1, T5
- bog_cisd: CISD-II, CISD-XV
- bom_ctrm: 1.1, 1.2, 3.8
- cbe_csf: GOV-1, GOV-2, GOV-4
- cbn_csf: Part1.1, Part8
- sa_js2: JS2-4, JS2-8.6
- bcbs_239: Principle 1
- bot_cyber: Ch1.1, Ch7.1
- cpmi_pfmi: CG.GOV, PFMI.P2
- eba_ict: 3.4.7
- ecb_croe: CROE.2.1.1, CROE.2.1.2
- ffiec_is: I.A, I.B, I.C, II.C.7(e)
- hipaa_sr: §164.308(a)(5)(i), §164.308(a)(5)(ii)(A)
- iosco_cyber: GOV-2, GOV-4
- nydfs_500: 500.4, 500.10
- sebi_cscrf: CAPACITY, GV.RR, PR.AT
- cmmc_2: AT
- nrc_73_54: RG5.71-C-AT
- tsa_psd: SD-2 Sec H
- doe_c2m2: WORKFORCE
- awia: AWWA Sec 8
- fca_sysc_13: SYSC 13.5.1, SYSC 13.6.1
- hitrust_csf: 02.b
- iso_27799: 7.2
- lloyds_ms: MS8.13
- naic_ds: 4-personnel, 4-training, 4C
- nhs_dspt: NDG-2.1, NDG-3.1, NDG-3.2
- pra_ss1_23: P2.1
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PM-13
- Clauses only: /api/v1/controls/PM-13?fields=mappings
- Page for people: /controls/pm-13/