NIST 800-53 r5 · Controls catalogue · Family PM
PM-3Information Security and Privacy Resources
Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and Make available for expenditure, the planned information security and privacy resources.
Last updated: 04 July 2026 08:17 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (mostly)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 5,385 | Resources allocated to security programs enable proper design, implementation, and maintenance of access control mechanisms. |
CWE-798 | Use of Hard-coded Credentials | 2,013 | Planned investment enables secure credential storage and management systems instead of hard-coded credentials. |
CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | 777 | Capital planning and funding allow selection and ongoing support of strong cryptographic algorithms rather than weak or broken ones. |
CWE-693 | Protection Mechanism Failure | 614 | Explicit funding and documentation requirements reduce failures of protection mechanisms caused by under-resourcing. |
CWE-521 | Weak Password Requirements | 308 | Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies. |
CWE-1104 | Use of Unmaintained Third Party Components | 21 | Resource allocation in investment requests funds regular maintenance, patching, and updates of third-party components. |
CWE-657 | Violation of Secure Design Principles | 19 | Requiring security resources in capital planning supports adherence to secure design principles throughout the system lifecycle. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||