PM-3, Information Security and Privacy Resources, asks you to include the resources needed for security and privacy programs in capital planning and investment requests, document any exceptions, prepare the required documentation, and make the planned resources available to spend. Federal programs are bound by it. For others it answers a common question: is security funded or only promised?
What it means in practice
The final clause is the one auditors test. Planned resources must be made available for expenditure, not just written into a plan. The record suggests naming champions for security and privacy and assigning specialized expertise, and it says an Investment Review Board or similar group can oversee security and privacy aspects of investment decisions.
Evidence to collect
- Budget lines for security and privacy tools and staff
- Investment requests that name security and privacy needs
- A list of documented exceptions with reasons
- Actual spend compared with plan
Common gaps
- Security is funded from leftovers at year end
- Exceptions are verbal and never recorded
- Budget is approved but frozen before it is spent
How to implement it
- Add a security and privacy line to every investment request template.
- Track planned versus actual spend each quarter.
- Record each exception with an owner and a date to revisit.
Quick check
What turns a plan into evidence for PM-3?
Resources made available for expenditure, shown by approved budget and actual spend, with exceptions documented.
