# PM-29 — Risk Management Program Leadership Roles

- **Control ID:** PM-29
- **Family:** [PM](/md/families/PM.md)
- **Baselines:** No content available.
- **Enhancement of:** No content available.

## Description

Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.

## Discussion

The senior accountable official for risk management leads the risk executive (function) in organization-wide risk management activities.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [GV.RR-01](/md/csf/GV.RR-01.md) — Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- [GV.RR-02](/md/csf/GV.RR-02.md) — Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

## Related controls

- [PM-2](/md/controls/PM-2.md)
- [PM-19](/md/controls/PM-19.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.