Cyber Posture

NIST 800-53 r5 · Controls catalogue · Family PT

PT-1Policy and Procedures

Develop, document, and disseminate to {{ insert: param, pt-1_prm_1 }}: {{ insert: param, pt-01_odp.03 }} personally identifiable information processing and transparency policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls; Designate an {{ insert: param, pt-01_odp.04 }} to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and Review and update the current personally identifiable information processing and transparency: Policy {{ insert: param, pt-01_odp.05 }} and following {{ insert: param, pt-01_odp.06 }} ; and Procedures {{ insert: param, pt-01_odp.07 }} and following {{ insert: param, pt-01_odp.08 }}.

Last updated: 09 May 2026 03:25 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (0)

Weaknesses this control addresses (5)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-200Exposure of Sensitive Information to an Unauthorized Actor10,204Explicit policy scope and review cycles make improper disclosure of sensitive PII less likely to occur or persist.
CWE-862Missing Authorization8,680Requiring designated ownership and periodic updates ensures authorization checks are defined and maintained for PII operations.
CWE-284Improper Access Control4,832The policy defines roles, responsibilities, and compliance requirements that establish and govern access controls for PII.
CWE-285Improper Authorization1,230Documented procedures and management commitment directly support consistent authorization decisions during PII processing.
CWE-359Exposure of Private Personal Information to an Unauthorized Actor174PII transparency and processing policy plus procedures reduce the chance of unauthorized exposure of private personal information.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.

Other controls in family PT

PT-2 PT-3 PT-4 PT-5 PT-6 PT-7 PT-8