Control statement
- a.Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
- b.Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
- c.Review and revise the mission and business processes [Organization-defined: frequency].
Discussion
Protection needs are technology-independent capabilities that are required to counter threats to organizations, individuals, systems, and the Nation through the compromise of information (i.e., loss of confidentiality, integrity, availability, or privacy). Information protection and personally identifiable information processing needs are derived from the mission and business needs defined by organizational stakeholders, the mission and business processes designed to meet those needs, and the organizational risk management strategy. Information protection and personally identifiable information processing needs determine the required controls for the organization and the systems. Inherent to defining protection and personally identifiable information processing needs is an understanding of the adverse impact that could result if a compromise or breach of information occurs. The categorization process is used to make such potential impact determinations. Privacy risks to individuals can arise from the compromise of personally identifiable information, but they can also arise as unintended consequences or a byproduct of the processing of personally identifiable information at any stage of the information life cycle. Privacy risk assessments are used to prioritize the risks that are created for individuals from system processing of personally identifiable information. These risk assessments enable the selection of the required privacy controls for the organization and systems. Mission and business process definitions and the associated protection requirements are documented in accordance with organizational policies and procedures.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Mission and Business Process Definition as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to enterprise program governance, accountability, resources, metrics, and organization-wide risk decisions.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- program charters and policies
- governance meeting records
- risk and performance metrics
- resource and responsibility assignments
Common failure patterns
- program metrics count activity instead of outcomes
- system-level risks never reach enterprise governance
- responsibilities assigned without authority or resources
- privacy and security managed in separate silos
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PM-11a.
- PM-11a.[01]organizational mission and business processes are defined with consideration for information security;
- PM-11a.[02]organizational mission and business processes are defined with consideration for privacy;
- PM-11a.[03]organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
- PM-11b.
- PM-11b.[01]information protection needs arising from the defined mission and business processes are determined;
- PM-11b.[02]personally identifiable information processing needs arising from the defined mission and business processes are determined;
- PM-11c.the mission and business processes are reviewed and revised [Organization-defined: frequency].
Examine
- Information security program plan
- privacy program plan
- risk management strategy
- procedures for determining mission and business protection needs
- information security and privacy risk assessment results relevant to the determination of mission and business protection needs
- personally identifiable information processing policy
- personally identifiable information inventory
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for enterprise risk management
- organizational personnel responsible for determining information protection needs for mission and business processes
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for defining mission and business processes and their information protection needs
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.