PM-28 PM · Program Management

Risk Framing

LOW MODERATE HIGH
1 Overlay 4 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

    1. 1.Assumptions affecting risk assessments, risk responses, and risk monitoring;
    2. 2.Constraints affecting risk assessments, risk responses, and risk monitoring;
    3. 3.Priorities and trade-offs considered by the organization for managing risk; and
    4. 4.Organizational risk tolerance;
Discussion (NIST Supplemental Guidance)

Risk framing is most effective when conducted at the organization level and in consultation with stakeholders throughout the organization including mission, business, and system owners. The assumptions, constraints, risk tolerance, priorities, and trade-offs identified as part of the risk framing process inform the risk management strategy, which in turn informs the conduct of risk assessment, risk response, and risk monitoring activities. Risk framing results are shared with organizational personnel, including mission and business owners, information owners or stewards, system owners, authorizing officials, senior agency information security officer, senior agency official for privacy, and senior accountable official for risk management.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PM-28 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. the personnel to receive the results of risk framing activities is/are defined;
  2. the frequency for reviewing and updating risk framing considerations is defined;
  3. assumptions affecting risk assessments are identified and documented;
  4. assumptions affecting risk responses are identified and documented;
  5. assumptions affecting risk monitoring are identified and documented;
  6. constraints affecting risk assessments are identified and documented;
  7. constraints affecting risk responses are identified and documented;
  8. constraints affecting risk monitoring are identified and documented;
  9. priorities considered by the organization for managing risk are identified and documented;
  10. trade-offs considered by the organization for managing risk are identified and documented;
  11. organizational risk tolerance is identified and documented;
  12. the results of risk framing activities are distributed to <PM-28_ODP[01] personnel>;
  13. risk framing considerations are reviewed and updated <PM-28_ODP[02] frequency>.

Examine

[SELECT FROM: Information security program plan; privacy program plan; supply chain risk management strategy; documentation of risk framing activities; policies and procedures for risk framing activities; risk management strategy].

Interview

[SELECT FROM: Organizational personnel (including mission, business, and system owners or stewards; authorizing officials; senior agency information security officer; senior agency official for privacy; and senior accountable official for risk management)].

Test

[SELECT FROM: Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing; organizational processes for risk framing; mechanisms supporting the development, review, update, and approval of risk framing].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

Not applicable at this tier.

HIGH

  • Base control: Added (beyond standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PM-28. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Information security program plan
  • privacy program plan
  • supply chain risk management strategy
  • policies and procedures for risk framing activities
  • risk management strategy

Testing

  • Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing
  • organizational processes for risk framing
  • mechanisms supporting the development, review, update, and approval of risk framing

Other Records

  • documentation of risk framing activities