Navigate

PM-15

PM-15: Contacts with Security Groups and Associations

The organization establishes and institutionalizes contact with selected groups and associations within the security community:

a: To facilitate ongoing security education and training for organizational personnel;

b: To maintain currency with recommended security practices, techniques, and technologies; and

c: To share current security-related information including threats, vulnerabilities, and incidents.

Supplemental

Ongoing contact with security groups and associations is of paramount importance in an environment of rapidly changing technologies and threats. Security groups and associations include, for example, special interest groups, forums, professional associations, news groups, and/or peer groups of security professionals in similar organizations. Organizations select groups and associations based on organizational missions/business functions. Organizations share threat, vulnerability, and incident information consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod)

CSF Categories
ID.RA-2, RS.AN-5, RS.CO-5

Related Controls

The controls below (if any) were marked by NIST as being related to PM-15.

Control	Description
SI-5	The organization: a: Receives information system security alerts, advisories, and directives from [organization-defined external organizations] on an ongoing basis; b: Generates internal security alerts, advisories, and directives as deemed necessary; c: Disseminates security alerts, advisories, and directives to: [one or more of {{ insert: param, si-5_prm_3 }} / {{ insert: param, si-5_prm_4 }} / {{ insert: param, si-5_prm_5 }} ]; and d: Implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.

Control

Description

SI-5

The organization:

a: Receives information system security alerts, advisories, and directives from [organization-defined external organizations] on an ongoing basis;

b: Generates internal security alerts, advisories, and directives as deemed necessary;

c: Disseminates security alerts, advisories, and directives to: [one or more of {{ insert: param, si-5_prm_3 }} / {{ insert: param, si-5_prm_4 }} / {{ insert: param, si-5_prm_5 }} ]; and

d: Implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.

Enhancements

The controls below (if any) add on to the requirements of PM-15.

Control	Description
No controls

Related CCIs

The CCIs below are tied to PM-15.

CCI	Definition
CCI-003010	Establish and institutionalize contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.
CCI-003011	Establish and institutionalize contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.
CCI-003012	Establish and institutionalize contact with selected groups and associations within the security community to share current security information including threats, vulnerabilities, and incidents.