NIST 800-53 r5 · Controls catalogue · Family PM
PM-9Risk Management Strategy
Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk to individuals resulting from the authorized processing of personally identifiable information; Implement the risk management strategy consistently across the organization; and Review and update the risk management strategy {{ insert: param, pm-09_odp }} or as required, to address organizational changes.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 18 mapping(s) from 1 framework(s): CSF 2.0 18 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 5,367 | Risk management strategy defines organization-wide access control policies and risk acceptance, directly reducing improper access control weaknesses. |
CWE-269 | Improper Privilege Management | 3,104 | Strategy development and consistent implementation enforce privilege management and least-privilege principles across systems. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Strategy requires assessment and assignment of permissions for critical resources, reducing incorrect default or inherited permissions. |
CWE-285 | Improper Authorization | 1,356 | Comprehensive risk strategy includes authorization requirements and reviews, making improper authorization harder to overlook or exploit. |
CWE-693 | Protection Mechanism Failure | 613 | Regular review and update of the risk strategy detects and corrects protection mechanism failures before exploitation. |
CWE-657 | Violation of Secure Design Principles | 19 | Risk management strategy explicitly incorporates secure design principles and requires periodic updates to address design violations. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||