PM-29, Risk Management Program Leadership Roles, has two parts. Appoint a Senior Accountable Official for Risk Management to align security and privacy processes with strategic, operational and budget planning. Then establish a Risk Executive function to look at risk across the whole organization. NIST 800-53 binds federal systems and, by contract, other parties. Everyone else can use it as a reference for who owns risk.
What it means in practice
The record adds one line of guidance. The senior accountable official leads the risk executive function in organization wide risk management. In a small company this is usually the CEO, COO or CTO, with a risk group of a few leaders that meets on a schedule.
The point is that risk decisions are not left to whoever happens to file the ticket. Someone senior owns them, and a group sees the whole picture.
This control also feeds PM-9, the risk management strategy, which names the same official.
Evidence to collect
- Written appointment of the accountable official
- Charter for the risk executive group with members and cadence
- Minutes showing risk acceptance and prioritization decisions
- The risk register this group reviews
Common gaps
- The accountable official is the security engineer, with no budget authority
- The risk group meets once and never again
- Risk acceptances are signed by whoever is closest, not by the owner
How to implement it
- Name the official in writing and tie them to budget decisions.
- Set a quarterly meeting with a standing agenda: top risks, acceptances, exceptions.
- Keep minutes and link them to risk register entries.
Quick check
Who should be the senior accountable official in a small company?
Someone with enough authority to align risk with planning and budget, often a founder or an executive. The statement does not fix a title.
