NIST 800-53 PM-9 Risk Management Strategy: What a Plan Needs

PM-9, Risk Management Strategy, asks you to develop a comprehensive strategy to manage security risk to the organization and others, and privacy risk to individuals from the authorized processing of personally identifiable information. You must implement it consistently across the organization and review and update it on a defined schedule or when the organization changes.

NIST 800-53 binds federal systems and others by contract. For everyone else, it is a clean outline for the risk strategy that a customer or auditor may ask to read.

What it means in practice

The record spells out what a strategy contains:

• An expression of security and privacy risk tolerance
• Risk mitigation strategies
• Acceptable risk assessment methodologies
• A process for evaluating risk against that tolerance across the organization
• Approaches for monitoring risk over time

The senior accountable official for risk management (see PM-29) aligns security management with strategic, operational and budget planning. The risk executive function, which that official leads, helps apply the strategy consistently. The record also says the strategy can take input from internal and external sources so it is broad, and that the supply chain strategy in PM-30 can feed it.

A useful test of a strategy is whether two people scoring the same risk would reach the same answer. If they would not, the methodology and tolerance are too vague.

Implementing consistently is where most programs slip. A strategy that governs the main product and is ignored by an acquired team is a gap.

Evidence to collect

• The risk management strategy document with approval and version history
• The stated risk tolerance with thresholds
• The risk assessment methodology, with scoring scales
• A current risk register scored with that methodology
• Records of the risk executive group applying the strategy
• Review dates and the changes made

Common gaps

• The strategy and the risk register use different scales
• Privacy risk is missing, only security risk is covered
• Tolerance is a sentence with no numbers or approval rules
• Business units run their own methods
• The document was written for an audit and never opened again

How to implement it

• Start from the PM-28 framing and write the five elements above.
• Pick one scoring method and use it everywhere, including privacy risk.
• Define who may accept risk at each level and for how long.
• Feed the register, the vulnerability backlog and vendor reviews into it.
• Schedule review and record changes.

See it in a demo

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NIST SP 800-53 Rev 5, PM-9 Risk Management Strategy
• NIST OSCAL catalog for SP 800-53 Rev 5