PM-32, Purposing, asks you to analyze the information resources supporting mission essential services to confirm they are used consistent with their intended purpose. It is a short control with a useful idea. Systems drift. A reporting server becomes a file share, and a staging box starts serving customers.
What it means in practice
NIST explains the risk. Over time systems get used for functions outside their intended mission, which exposes them to unintended environments and raises threat exposure. For mission essential services this matters most.
The analysis is simple to state. For each essential service, list the systems behind it, say what each was built for, and check what it really does today.
NIST 800-53 binds federal systems and others by contract. Other teams can run the same check as a reference.
Evidence to collect
- A list of essential services and the systems that support them
- Documented intended purpose for each system
- Analysis notes or a review record comparing intended and actual use
- Actions taken when drift was found
Common gaps
- Intended purpose was never written down
- Review looks only at the network diagram, not at real use
- Drift is found but nobody owns the fix
How to implement it
- Start with the five or ten services you cannot lose.
- Write one line of intended purpose per system.
- Compare it to traffic, users and data stored, then review each year.
Quick check
What does PM-32 look for?
Systems that support essential services but are used for things outside their intended mission or business function.
