NIST 800-53 r5 · Controls catalogue · Family PM
PM-6Measures of Performance
Develop, monitor, and report on the results of information security and privacy measures of performance.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (5)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-400 | Uncontrolled Resource Consumption | 3,324 | Performance metrics and monitoring inherently track resource consumption patterns, making uncontrolled consumption easier to detect and mitigate. |
CWE-770 | Allocation of Resources Without Limits or Throttling | 1,979 | Measures of performance include tracking allocation behavior and throttling effectiveness, reducing the window for resource exhaustion attacks. |
CWE-693 | Protection Mechanism Failure | 476 | Ongoing measurement and reporting of security control performance provides visibility into protection mechanism failures, enabling timely remediation. |
CWE-778 | Insufficient Logging | 23 | Developing and monitoring security performance measures requires systematic collection and analysis of control effectiveness data, directly reducing insufficient logging. |
CWE-390 | Detection of Error Condition Without Action | 14 | Reporting on security performance measures requires confirming that detected error conditions trigger appropriate actions rather than being ignored. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||