NIST 800-53 r5 · Controls catalogue · Family PS

PS-9Position Descriptions

Incorporate security and privacy roles and responsibilities into organizational position descriptions.

Last updated: 22 August 2026 07:11 UTC

Implementations targeting this control (0)

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-284`	Improper Access Control	6,900+	Clear role definitions in position descriptions are a prerequisite for implementing and enforcing proper access control decisions.
`CWE-269`	Improper Privilege Management	3,400+	Documenting security and privacy duties per position provides the foundation for consistent and correct privilege management across the organization.
`CWE-732`	Incorrect Permission Assignment for Critical Resource	1,900+	Security responsibilities documented in job descriptions guide correct initial and ongoing permission assignments for critical resources.
`CWE-285`	Improper Authorization	1,500+	Explicitly stated responsibilities per position improve the accuracy and consistency of authorization decisions tied to those roles.
`CWE-250`	Execution with Unnecessary Privileges	300+	Position descriptions that explicitly define security responsibilities directly support assignment of only the privileges needed for a role, reducing execution with unnecessary privileges.
`CWE-272`	Least Privilege Violation	38	Incorporating least-privilege expectations into every position description makes violations of the principle harder to occur by default.

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.