NIST 800-53 r5 · Controls catalogue · Family PM
PM-9Risk Management Strategy
Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk to individuals resulting from the authorized processing of personally identifiable information; Implement the risk management strategy consistently across the organization; and Review and update the risk management strategy {{ insert: param, pm-09_odp }} or as required, to address organizational changes.
Last updated: 22 August 2026 07:11 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-284 | Improper Access Control | 6,900+ | Risk management strategy defines organization-wide access control policies and risk acceptance, directly reducing improper access control weaknesses. |
CWE-269 | Improper Privilege Management | 3,400+ | Strategy development and consistent implementation enforce privilege management and least-privilege principles across systems. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,900+ | Strategy requires assessment and assignment of permissions for critical resources, reducing incorrect default or inherited permissions. |
CWE-285 | Improper Authorization | 1,500+ | Comprehensive risk strategy includes authorization requirements and reviews, making improper authorization harder to overlook or exploit. |
CWE-693 | Protection Mechanism Failure | 700+ | Regular review and update of the risk strategy detects and corrects protection mechanism failures before exploitation. |
CWE-657 | Violation of Secure Design Principles | 20 | Risk management strategy explicitly incorporates secure design principles and requires periodic updates to address design violations. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||