Cyber Resilience

NIST 800-53 r5 · Controls catalogue · Family PT

PT-1Policy and Procedures

Develop, document, and disseminate to {{ insert: param, pt-1_prm_1 }}: {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls; Designate an {{ insert: param, pt-01_odp.04 }} to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and Review and update the current personally identifiable information processing and transparency: Policy {{ insert: param, pt-01_odp.05 }} and following {{ insert: param, pt-01_odp.06 }} ; and Procedures {{ insert: param, pt-01_odp.07 }} and following {{ insert: param, pt-01_odp.08 }}.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 4 mapping(s) from 1 framework(s): CSF 2.0 4 (partial)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (0)

Weaknesses this control addresses (5)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-200Exposure of Sensitive Information to an Unauthorized Actor10,501Explicit policy scope and review cycles make improper disclosure of sensitive PII less likely to occur or persist.
CWE-862Missing Authorization9,346Requiring designated ownership and periodic updates ensures authorization checks are defined and maintained for PII operations.
CWE-284Improper Access Control5,367The policy defines roles, responsibilities, and compliance requirements that establish and govern access controls for PII.
CWE-285Improper Authorization1,356Documented procedures and management commitment directly support consistent authorization decisions during PII processing.
CWE-359Exposure of Private Personal Information to an Unauthorized Actor190PII transparency and processing policy plus procedures reduce the chance of unauthorized exposure of private personal information.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.

Other controls in family PT

PT-2 PT-3 PT-4 PT-5 PT-6 PT-7 PT-8