NIST 800-53 r5 · Controls catalogue · Family PT
PT-1Policy and Procedures
Develop, document, and disseminate to {{ insert: param, pt-1_prm_1 }}: {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls; Designate an {{ insert: param, pt-01_odp.04 }} to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and Review and update the current personally identifiable information processing and transparency: Policy {{ insert: param, pt-01_odp.05 }} and following {{ insert: param, pt-01_odp.06 }} ; and Procedures {{ insert: param, pt-01_odp.07 }} and following {{ insert: param, pt-01_odp.08 }}.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (5)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,204 | Explicit policy scope and review cycles make improper disclosure of sensitive PII less likely to occur or persist. |
CWE-862 | Missing Authorization | 8,680 | Requiring designated ownership and periodic updates ensures authorization checks are defined and maintained for PII operations. |
CWE-284 | Improper Access Control | 4,832 | The policy defines roles, responsibilities, and compliance requirements that establish and govern access controls for PII. |
CWE-285 | Improper Authorization | 1,230 | Documented procedures and management commitment directly support consistent authorization decisions during PII processing. |
CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | 174 | PII transparency and processing policy plus procedures reduce the chance of unauthorized exposure of private personal information. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||