An organization-defined parameter, or ODP, is a blank in a NIST control where someone must choose a value, such as how fast to install updates or how often to review an inventory. The control does not pick the number. The agency, program or your own documented decision does, and an assessor will ask where it is written.
What they look like
Open the Rev. 5 catalog and you will see controls like these:
- SI-2 says to install security-relevant updates within a defined period of release
- CM-8 says to review and update the component inventory on a defined schedule
- AU-11 says to retain audit records for a defined period
- RA-5 says to monitor and scan on a defined frequency
In each, the number is missing on purpose. NIST wrote the control to be reused across systems with different risk, so it leaves the value to the organization.
Who sets the value
It depends on your situation.
- A contract or program rule sets it. Federal baselines used by a program may already assign values. Follow them.
- An agency sponsor or authorizing official sets it for the system.
- If nobody above you sets it, you decide, document the reasoning and get an approver.
The CMMC rule text uses the same idea. For Level 3 it says ODPs are assigned in its table, and that "organization-defined" otherwise means as determined by the contractor.
How to choose a defensible value
- Start with what you already do and can prove. A promise you cannot keep is worse than a longer window you meet.
- Tie it to risk. Internet-facing, high-impact systems get shorter windows.
- Write the value, the reason and the approver.
- Set a review date for the decision.
Where to record it
Put every ODP value in one table with these columns: control, parameter, value, source, owner and date. Link the table from the system plan. NIST's guidance on system plans, SP 800-18 Rev. 2, says plans describe the status of selected controls, so the plan is the natural home.
A small example
For SI-2 you might write: install critical security updates for internet-facing components within a stated number of days, decided by the security lead, based on the sponsor's baseline, reviewed in January. The number is yours or your program's. Do not copy one from a blog.
Check your evidence against the value
After you set a value, test it. Pull the last quarter of fix records and count how many met the window. If many missed it, either improve the process or revise the value with approval, and record the exception.
Quick check
Who fills an ODP when a contract is silent?
You do, with a documented rationale and an approver, unless an agency sponsor or program rule sets it.
Can I copy numbers from another company's policy?
You can use them as a reference point, but the value should match your risk and what you can show you meet.
Safeguard's policies and gates let you encode the values you choose as checks, and compliance and evidence automation keeps the records. A free scan is at gold.safeguard.sh/scan.
Sources
- NIST SP 800-53 Rev. 5 catalog (OSCAL content), controls SI-2, CM-8, AU-11 and RA-5
- 32 CFR 170.14, CMMC model
- NIST SP 800-18 Rev. 2
Last reviewed: 19 October 2026.
