Cyber · Trackr The Free Compliance Library
⌘K
PM · Plan wizard

Program Management Plan

Documents how the organizational Program Management framework — Information Security Program Plan, Privacy Program Plan, Risk Management Strategy, Continuous Monitoring Strategy, POA&M process, system inventory, enterprise architecture, mission / business-process definition, insider-threat program, workforce program, testing / training / monitoring program, threat-awareness program, supply-chain-risk strategy, data governance, and complaint management — applies to this system. Covers the controls of the PM family in NIST SP 800-53 r5 and aligns with NIST SP 800-37 r2 (RMF), NIST SP 800-39 (Managing Information Security Risk), NIST SP 800-181 r1 (Workforce Framework), NIST IR 8062 (Privacy Risk Management Framework), and OMB Circular A-130 (Managing Information as a Strategic Resource). Note: PM controls are organizational rather than system-specific — most controls in this plan are documented as inherited from the organization's PM program with system-specific extensions where applicable.

1 System metadata
Full official name of the information system.
Short identifier used in headings and references.
Role or named individual accountable for the system.
Describe what falls inside the authorization boundary - components, services, networks, data flows.
2 Baseline
PM is a privacy-baseline family. PM controls are organizational (not in the LMH security baselines); the PII-related PM controls (PM-18 through PM-27) live in the NIST Privacy baseline. Choose NIST Privacy below for in-baseline coverage of those controls. The non-privacy PM controls render as out-of-baseline regardless.
Determines which controls in this family appear in your plan.
3 Program Management approach
Approach basics → §4.x

Organizational program identifiers and locations.

Name of the organization that operates the org-level PM program (e.g., 'Department of Acme', 'Federal Bureau X', 'Acme Corp').
Where the organizational ISPP is maintained (e.g., 'eMASS Org-Level Package OL-001', '/repo/org-compliance/ispp.md').
Senior info-security officer accountable for the ISPP (typically CISO or equivalent).
Where the org Privacy Program Plan is maintained.
SAOP / Chief Privacy Officer.
Where the org RMS is maintained.
Where the org CA-7 / PM-31 ConMon strategy is maintained.
Where the org system inventory is maintained (e.g., 'CMDB', 'FISMA-Cybersecurity Performance Goals (CPG) reporting tool', 'eMASS').
How this system is identified in the org PM-5 inventory.
Org POA&M tracking system (e.g., 'eMASS POA&M module', 'Archer POA&M', 'Internal GRC tool').
Convention for this system's POA&M items (e.g., 'POAM-CTLS-').
ISPP / Inventory / Purpose (PM-1, PM-5, PM-32) → §4.x

Where this system fits in the organization's program plan and inventory.

Reference to the section / appendix / inventory entry that identifies this system in the org ISPP.
ISSO / system-owner roles assigned to this system per the ISPP definitions.
Per PM-32 — how this system's purpose aligns with the org mission. Reference to mission / business-process documentation.
How often the inventory entry for this system is verified for currency.
Resources and Workforce (PM-3, PM-13) → §4.x

Org budget and workforce program as they apply to this system.

How this system requests resources from the org budget process. Reference org capital-planning workflow.
How unfunded requirements for this system are escalated through the org PM-3 process. Reference SA-2 system-level allocation.
How roles supporting this system map to the org PM-13 workforce framework (NICE Framework / DoD 8140). Reference AT-3.
POA&M Management (PM-4) → §4.x

How this system contributes to the org POA&M process.

How this system's POA&M items flow into the org PM-4 process (org-level dashboard, monthly roll-up, AO review cycle).
How often this system's POA&M is reviewed (e.g., 'Weekly system-internal review; monthly org submission'). Common.
Evidence required to close a POA&M item. Test results, configuration verification, control-effectiveness attestation.
When overdue POA&M items escalate (e.g., '>30 days past due → ISSM brief; >60 days → AO awareness').
Enterprise Architecture and Business Processes (PM-7, PM-11) → §4.x

How this system fits the org architecture and supports mission processes.

Where this system is documented in the org EA (segment, capability, transition plan).
    Suggested:
    If this system supports a Mission Essential Function: reference to the MEF. Reference RA-9 / CP-2.
    Risk Management Strategy (PM-9, PM-28) → §4.x

    Org RMS and this system's tier within it.

    How often this system's risk posture surfaces to the org RMS (typical: quarterly + on significant change).
    Per PM-28 — how this system contributes to / inherits from the org risk-framing inputs (assumptions, constraints, risk tolerance, priorities).
    Pointer to the org risk-tolerance statement that anchors RA-7 decisions for this system.
    Testing, Training, Monitoring (PM-14, PM-31) → §4.x

    Org-wide assessment and ConMon strategy as applied here.

    How org-wide testing (annual control assessments, periodic incident-response exercises, training programs) covers this system.
    If org ConMon strategy uses tiered cadences: which tier this system is assigned to (e.g., 'Tier 2 — moderate-impact, monthly attestation cycle').
      Suggested:
      How often this system reports metrics to the org PM-31 program (typical: monthly automated + quarterly review).
      Protecting CUI on External Systems (PM-17) → §4.x

      Per PM-17, controls when CUI extends beyond the system boundary.

      Per PM-17 — what protections are required of external systems / organizations handling CUI (NIST SP 800-171 r3 compliance, contract clauses, attestations). Reference SA-9 / SR-8.
      How attestations of external compliance are received and validated.
      Insider Threat Program (PM-12) → §4.x

      How this system participates in the org insider-threat program.

      How org IT-program indicators relevant to this system are routed to system staff. Reference IR / PS-8.
      Threat Awareness and External Engagement (PM-15, PM-16) → §4.x

      How this system benefits from org threat intelligence and external engagements.

      Pointer to the org PM-16 threat-awareness program / TIP.
      How org threat-intel feeds (TIP, advisories, sector-ISAC reports) reach this system's defenders. Reference SI-5 / RA-10.
      Privacy Program (PM-18 through PM-27) → §4.x

      Org privacy program as it applies to this system.

      How often the org privacy plan is reviewed (typical: 'Annually + on significant change'). Reference PT plan.
      How this system contributes to the org disclosure-accounting record. Where the records live. Reference PT-6.
      How this system contributes to / inherits from the org PII quality-management program. Data-correction workflows, accuracy verification.
      How privacy complaints affecting this system are handled. Routing to SAOP, response SLA.
      How this system contributes to org privacy-reporting requirements (FISMA Annual Report, OMB privacy reporting).
      Data Governance (PM-23, PM-24) → §4.x

      Data Governance Body and Data Integrity Board.

      If DGB exists: pointer to charter / membership.
      Members of the DIB if required. Reference PT-8 for matching agreements.
      Supply Chain Risk Management Strategy (PM-30) → §4.x

      Org-level SCRM strategy and this system's place in it.

      Where the org SCRM strategy lives. Reference SR plan.
      How this system is scoped in the org SCRM strategy (critical / standard tier; specific covered components).
      Role of the org SCRM team / how this system interacts with it. Reference SR-2(1).
      PM Scope and Coverage → §2.x

      Quantitative scope numbers that anchor metrics later in the plan.

      Order-of-magnitude personnel count for the organization. Anchors org-level program scope.
      Approximate count of systems in the org PM-5 inventory.
      Approximate count of open POA&M items for this system.
      Approximate count of distinct metrics this system reports to the org PM-31 ConMon program.
      Program-Management Metrics & KPIs → §6.x

      Metrics tracked to demonstrate PM control effectiveness.

        Suggested:
        Cross-references to other RMF artifacts → §7

        Where this plan plugs into the broader RMF package.

        Where in the SSP the PM control implementations are summarized (e.g., 'SSP §13.18 — meta program').
        Summary of how each family plan inherits from PM (CA from PM-31, RA from PM-9, SR from PM-30, etc.). High-level pointer table.
        How this system's PM-31 ConMon strategy reference appears in CA-7. Reference CA plan.
        How this system's PM-9 / PM-28 RMS reference appears in RA-3 / RA-7. Reference RA plan.
        How this system's PM-30 SCRM strategy reference appears in SR-2. Reference SR plan.
        How this system's PM-18 / PM-19 privacy program reference appears in PT-2 / PT-5 / PT-6. Reference PT plan.
        How insider-threat indicators flow between this system's IR plan and the org PM-12 program.
        4 Per-control implementation

        Pick a baseline in section 2 and the applicable controls will appear here. Each control gets a card with the official text, related controls, linked CCIs, and fields for your implementation status, narrative, responsible role, and evidence.

        5 Document metadata

        Your answers autosave to this browser. Click Save progress to download a JSON file you can re-upload later or share.