Navigate

PM-3

PM-3: Information Security Resources

The organization:

a: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement;

b: Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and

c: Ensures that information security resources are available for expenditure as planned.

Supplemental

Organizations consider establishing champions for information security efforts and as part of including the necessary resources, assign specialized expertise and resources as needed. Organizations may designate and empower an Investment Review Board (or similar group) to manage and provide oversight for the information security-related aspects of the capital planning and investment control process.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Privacy (CNSSI 1253), Privacy (High), Privacy (Low), Privacy (Mod)

CSF Categories
ID.GV-4

Related Controls

The controls below (if any) were marked by NIST as being related to PM-3.

Control	Description
PM-4	The organization: a: Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems: 1: Are developed and maintained; 2: Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and 3: Are reported in accordance with OMB FISMA reporting requirements. b: Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
SA-2	The organization: a: Determines information security requirements for the information system or information system service in mission/business process planning; b: Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and c: Establishes a discrete line item for information security in organizational programming and budgeting documentation.

Control

Description

PM-4

The organization:

a: Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems:
- 1: Are developed and maintained;
- 2: Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
- 3: Are reported in accordance with OMB FISMA reporting requirements.

b: Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

SA-2

The organization:

a: Determines information security requirements for the information system or information system service in mission/business process planning;

b: Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and

c: Establishes a discrete line item for information security in organizational programming and budgeting documentation.

Enhancements

The controls below (if any) add on to the requirements of PM-3.

Control	Description
No controls

Related CCIs

The CCIs below are tied to PM-3.

CCI	Definition
CCI-000080	Include the resources needed to implement the information security programs in capital planning and investment requests and document all exceptions to this requirement.
CCI-000081	The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.
CCI-000141	Make available for expenditure, the planned information security resources.