Control statement
- a.Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
- b.Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.
Discussion
The senior accountable official for risk management leads the risk executive (function) in organization-wide risk management activities.
From control text to operational evidence
Use Risk Management Program Leadership Roles as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to enterprise program governance, accountability, resources, metrics, and organization-wide risk decisions.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- program charters and policies
- governance meeting records
- risk and performance metrics
- resource and responsibility assignments
Common failure patterns
- program metrics count activity instead of outcomes
- system-level risks never reach enterprise governance
- responsibilities assigned without authority or resources
- privacy and security managed in separate silos
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PM-29a.
- PM-29a.[01]a Senior Accountable Official for Risk Management is appointed;
- PM-29a.[02]a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes;
- PM-29b.
- PM-29b.[01]a Risk Executive (function) is established;
- PM-29b.[02]a Risk Executive (function) views and analyzes risk from an organization-wide perspective;
- PM-29b.[03]a Risk Executive (function) ensures that the management of risk is consistent across the organization.
Examine
- Information security program plan
- privacy program plan
- risk management strategy
- supply chain risk management strategy
- documentation of appointment, roles, and responsibilities of a Senior Accountable Official for Risk Management
- documentation of actions taken by the Official
- documentation of the establishment, policies, and procedures of a Risk Executive (function)
Interview
- Senior Accountable Official for Risk Management
- chief information officer
- senior agency information security officer
- senior agency official for privacy
- organizational personnel with information security and privacy program responsibilities
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.