# PM-9 — Risk Management Strategy - **Control ID:** PM-9 - **Family:** [PM](/md/families/PM.md) - **Baselines:** No content available. - **Enhancement of:** No content available. ## Description Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk to individuals resulting from the authorized processing of personally identifiable information; Implement the risk management strategy consistently across the organization; and Review and update the risk management strategy \[assignment\] or as required, to address organizational changes. ## Discussion An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in \[PM-30\](\#pm-30) can also provide useful inputs to the organization-wide risk management strategy. ## Implementation guidance No content available. ## CSF 2.0 subcategories - [DE.AE-04](/md/csf/DE.AE-04.md) — The estimated impact and scope of adverse events are understood - [GV.OC-02](/md/csf/GV.OC-02.md) — Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered - [GV.OV-01](/md/csf/GV.OV-01.md) — Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction - [GV.OV-02](/md/csf/GV.OV-02.md) — The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks - [GV.RM-01](/md/csf/GV.RM-01.md) — Risk management objectives are established and agreed to by organizational stakeholders - [GV.RM-02](/md/csf/GV.RM-02.md) — Risk appetite and risk tolerance statements are established, communicated, and maintained - [GV.RM-03](/md/csf/GV.RM-03.md) — Cybersecurity risk management activities and outcomes are included in enterprise risk management processes - [GV.RM-04](/md/csf/GV.RM-04.md) — Strategic direction that describes appropriate risk response options is established and communicated - [GV.RM-05](/md/csf/GV.RM-05.md) — Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties - [GV.RM-06](/md/csf/GV.RM-06.md) — A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated - [GV.RM-07](/md/csf/GV.RM-07.md) — Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions - [GV.SC-03](/md/csf/GV.SC-03.md) — Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes - [GV.SC-09](/md/csf/GV.SC-09.md) — Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle - [ID.RA-04](/md/csf/ID.RA-04.md) — Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded - [ID.RA-06](/md/csf/ID.RA-06.md) — Risk responses are chosen, prioritized, planned, tracked, and communicated - [PR.IR-04](/md/csf/PR.IR-04.md) — PR.IR-04 - [RC.RP-04](/md/csf/RC.RP-04.md) — Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms ## Related controls - [AC-1](/md/controls/AC-1.md) - [AT-1](/md/controls/AT-1.md) - [AU-1](/md/controls/AU-1.md) - [CA-1](/md/controls/CA-1.md) - [CA-2](/md/controls/CA-2.md) - [CA-5](/md/controls/CA-5.md) - [CA-6](/md/controls/CA-6.md) - [CA-7](/md/controls/CA-7.md) - [CM-1](/md/controls/CM-1.md) - [CP-1](/md/controls/CP-1.md) - [IA-1](/md/controls/IA-1.md) - [IR-1](/md/controls/IR-1.md) - [MA-1](/md/controls/MA-1.md) - [MP-1](/md/controls/MP-1.md) - [PE-1](/md/controls/PE-1.md) - [PL-1](/md/controls/PL-1.md) - [PL-2](/md/controls/PL-2.md) - [PM-2](/md/controls/PM-2.md) - [PM-8](/md/controls/PM-8.md) - [PM-18](/md/controls/PM-18.md) - [PM-28](/md/controls/PM-28.md) - [PM-30](/md/controls/PM-30.md) - [PS-1](/md/controls/PS-1.md) - [PT-1](/md/controls/PT-1.md) - [PT-2](/md/controls/PT-2.md) - [PT-3](/md/controls/PT-3.md) - [RA-1](/md/controls/RA-1.md) - [RA-3](/md/controls/RA-3.md) - [RA-9](/md/controls/RA-9.md) - [SA-1](/md/controls/SA-1.md) - [SA-4](/md/controls/SA-4.md) - [SC-1](/md/controls/SC-1.md) - [SC-38](/md/controls/SC-38.md) - [SI-1](/md/controls/SI-1.md) - [SI-12](/md/controls/SI-12.md) - [SR-1](/md/controls/SR-1.md) - [SR-2](/md/controls/SR-2.md) --- Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.