# PM-23 — Data Governance Body

- **Control ID:** PM-23
- **Family:** [PM](/md/families/PM.md)
- **Baselines:** No content available.
- **Enhancement of:** No content available.

## Description

Establish a Data Governance Body consisting of \[assignment\] with \[assignment\].

## Discussion

A Data Governance Body can help ensure that the organization has coherent policies and the ability to balance the utility of data with security and privacy requirements. The Data Governance Body establishes policies, procedures, and standards that facilitate data governance so that data, including personally identifiable information, is effectively managed and maintained in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidance. Responsibilities can include developing and implementing guidelines that support data modeling, quality, integrity, and the de-identification needs of personally identifiable information across the information life cycle as well as reviewing and approving applications to release data outside of the organization, archiving the applications and the released data, and performing post-release monitoring to ensure that the assumptions made as part of the data release continue to be valid. Members include the chief information officer, senior agency information security officer, and senior agency official for privacy. Federal agencies are required to establish a Data Governance Body with specific roles and responsibilities in accordance with the \[EVIDACT\](\#511da9ca-604d-43f7-be41-b862085420a9) and policies set forth under \[OMB M-19-23\](\#d886c141-c832-4ad7-ac6d-4b94f4b550d3).

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [GV.RR-01](/md/csf/GV.RR-01.md) — Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- [GV.RR-02](/md/csf/GV.RR-02.md) — Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- [ID.AM-08](/md/csf/ID.AM-08.md) — Systems, hardware, software, services, and data are managed throughout their life cycles

## Related controls

- [AT-2](/md/controls/AT-2.md)
- [AT-3](/md/controls/AT-3.md)
- [PM-19](/md/controls/PM-19.md)
- [PM-22](/md/controls/PM-22.md)
- [PM-24](/md/controls/PM-24.md)
- [PT-7](/md/controls/PT-7.md)
- [SI-4](/md/controls/SI-4.md)
- [SI-19](/md/controls/SI-19.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.