NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PM-13, Security and Privacy Workforce, says to establish a security and privacy workforce development and improvement program.
The guidance lists the pieces. Define the knowledge, skills, and abilities needed for security and privacy duties. Develop role based training for people assigned those roles. Provide standards and guidelines for measuring and building qualifications for current staff and applicants. It also mentions career paths to encourage professionals to advance.
What it means in practice
This differs from general awareness training, which sits in AT-2. PM-13 is about the people who do security and privacy work: their skills, their growth, and whether the organization can hire and keep them.
A small company may have one security person and one privacy lead, or two engineers who carry both jobs. The control still applies. It asks whether you know what skills those roles need and whether you are building them on purpose.
Evidence to collect
- Role descriptions with required skills for security and privacy positions.
- A skills assessment or gap list for current staff.
- A training plan per role, with budget and dates.
- Completion records, such as courses and certifications.
- Hiring criteria or interview rubrics for security roles.
- Career path or progression documentation.
Common gaps
- Role descriptions that list tasks, not skills.
- Training done ad hoc and never tied to a gap.
- No plan for who covers when the one security person leaves.
- Privacy skills ignored.
- Certification counted, but not practice.
How to implement it
Write a skills matrix with columns for each role and rows for skills such as incident handling, secure development, cloud security, and privacy engineering. Mark current level and target level. Turn the gaps into a yearly plan with owners.
Mix training types: courses, internal rotations, tabletop exercises, conference attendance, and mentoring. Record each.
For developers in security roles, hands on practice helps more than slides. Reviewing real dependency findings from your own code teaches triage better than a lecture.
Add hiring standards and a succession note for each key role. Review the plan yearly and after reorganizations.
Try it yourself
Scan one of your own projects at gold.safeguard.sh/scan and use the findings as a team exercise in triage. It is free and runs in the browser.
Quick check
How is PM-13 different from AT-2?
AT-2 covers awareness training for all users. PM-13 covers developing the specialist workforce.
Are certifications required?
The control does not require any. They can be one measure of qualification, alongside demonstrated skills.
