NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PM-11, Mission and Business Process Definition, asks three things. Define the organization's mission and business processes with security and privacy risk in mind. Determine the information protection and personally identifiable information processing needs those processes create. Review and revise the processes on a schedule.
The guidance calls protection needs technology independent capabilities required to counter threats to confidentiality, integrity, availability, or privacy. Those needs, it says, determine the controls the organization and its systems require.
What it means in practice
Start with what the business does: take orders, ship product, handle claims, run a platform. For each process, ask what information it uses, what would hurt if it leaked, changed, or disappeared, and what personal data is involved.
Only then choose controls. This order avoids buying tools first and inventing reasons later.
Evidence to collect
- A list of business processes and owners.
- For each, a short statement of protection needs and personal data handled.
- Link from those needs to system categorization and control selection.
- Review records.
Common gaps
- A process list that omits the data each one uses.
- Security requirements copied from a template, not derived from the business.
- No review when the business changes.
How to implement it
Hold a short workshop with process owners. Capture needs in a table. Reference it from your system plans and risk register. Revisit when you launch a product line or enter a new market.
Quick check
Is this just a business impact analysis?
They overlap. A business impact analysis focuses on availability. PM-11 also covers confidentiality, integrity, and privacy needs.
