NIST 800-53 r5 · Controls catalogue · Family PM
PM-23Data Governance Body
Establish a Data Governance Body consisting of {{ insert: param, pm-23_odp.01 }} with {{ insert: param, pm-23_odp.02 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Promotes data classification, handling, and protection policies that limit unauthorized exposure of sensitive information. |
CWE-862 | Missing Authorization | 9,346 | Ensures missing authorization mechanisms for critical data functions are identified and remediated via policy. |
CWE-284 | Improper Access Control | 5,367 | Data governance body defines and oversees organizational access control policies for data resources, reducing improper access control. |
CWE-863 | Incorrect Authorization | 3,515 | Drives review and correction of flawed authorization logic applied to organizational data. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Provides oversight for correct permission and privilege assignments on data stores, files, and repositories. |
CWE-285 | Improper Authorization | 1,356 | Establishes accountability for authorization decisions and enforcement on data handling and access. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||