NIST 800-53 r5 · Controls catalogue · Family PM

PM-13Security and Privacy Workforce

Establish a security and privacy workforce development and improvement program.

Last updated: 09 May 2026 03:25 UTC

Implementations targeting this control (0)

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-200`	Exposure of Sensitive Information to an Unauthorized Actor	10,204	Trained staff understand data-handling requirements and are less likely to expose sensitive information through misconfiguration or poor design.
`CWE-284`	Improper Access Control	4,832	Security training teaches correct access-control models and enforcement, lowering the incidence of improper access control.
`CWE-287`	Improper Authentication	4,730	Development programs cover authentication best practices, making weak or missing authentication less likely.
`CWE-732`	Incorrect Permission Assignment for Critical Resource	1,824	Training addresses permission management, reducing incorrect permission assignments on critical resources.
`CWE-311`	Missing Encryption of Sensitive Data	552	Privacy and security curricula stress encryption requirements, reducing missing encryption of sensitive data.
`CWE-693`	Protection Mechanism Failure	476	Skilled personnel implement protection mechanisms correctly, lowering protection-mechanism failures.
`CWE-250`	Execution with Unnecessary Privileges	305	Workforce programs emphasize least-privilege principles, directly reducing unnecessary privilege assignments.
`CWE-657`	Violation of Secure Design Principles	19	The program explicitly teaches secure design principles, decreasing violations of those principles.

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.