NIST 800-53 r5 · Controls catalogue · Family PM
PM-13Security and Privacy Workforce
Establish a security and privacy workforce development and improvement program.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Trained staff understand data-handling requirements and are less likely to expose sensitive information through misconfiguration or poor design. |
CWE-284 | Improper Access Control | 5,367 | Security training teaches correct access-control models and enforcement, lowering the incidence of improper access control. |
CWE-287 | Improper Authentication | 4,908 | Development programs cover authentication best practices, making weak or missing authentication less likely. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Training addresses permission management, reducing incorrect permission assignments on critical resources. |
CWE-693 | Protection Mechanism Failure | 613 | Skilled personnel implement protection mechanisms correctly, lowering protection-mechanism failures. |
CWE-311 | Missing Encryption of Sensitive Data | 554 | Privacy and security curricula stress encryption requirements, reducing missing encryption of sensitive data. |
CWE-250 | Execution with Unnecessary Privileges | 333 | Workforce programs emphasize least-privilege principles, directly reducing unnecessary privilege assignments. |
CWE-657 | Violation of Secure Design Principles | 19 | The program explicitly teaches secure design principles, decreasing violations of those principles. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||