NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PM-14, Testing, Training, and Monitoring, asks you to implement a process that makes sure organizational plans for security and privacy testing, training, and monitoring are developed and maintained and continue to be executed. It also asks you to review those plans for consistency with the risk management strategy and the organization wide priorities for risk response.
The guidance says the process provides oversight and coordination of these activities. With continuous monitoring and common controls, organizations consolidate testing and monitoring that already happens as part of assessments for many controls.
What it means in practice
This is a control about the calendar. Many controls ask for a scan, a drill, or a training session. PM-14 asks who tracks all of them, whether they happened, and whether the plan matches your top risks.
An organization can pass every individual control on paper and still fail this one if nobody owns the overall schedule.
Evidence to collect
- A master plan or calendar listing tests, trainings, and monitoring activities with owners and frequencies.
- Completion records for a recent period.
- Evidence of plan review against the risk strategy, with date and reviewer.
- A record of missed or late items and what was done.
- Reports that consolidate results, such as a quarterly security review.
Common gaps
- Activities scattered across teams, with no single list.
- Plans that were set once and do not follow changes in risk.
- Missed items that go unnoticed.
- Monitoring that runs but no one reads.
How to implement it
Create the calendar first. List every recurring activity: vulnerability scans, penetration tests, restore tests, incident exercises, awareness training, access reviews, log reviews. Assign an owner and a due date to each.
Review it quarterly. Ask whether the plan reflects current top risks. If a new risk has no activity against it, add one. If an activity covers a risk that is gone, retire it.
Automate collection of results where possible, so that evidence arrives without chasing.
Try it yourself
The demo shows how recurring evidence collection can be automated and tracked in one place. You can also run a dependency check on a project with the free scan at gold.safeguard.sh/scan as one entry on your testing calendar.
Click through it at your own pace, or open it full screen.
Quick check
Is PM-14 a new activity or a coordination duty?
Mostly coordination. It ensures the activities required elsewhere are planned, done, and reviewed together.
How often should the plan be reviewed?
The control leaves it to you. Quarterly is common, and also after major changes in risk.
