| 💼 PM-1 Information Security Program Plan | | | | |
| 💼 PM-2 Information Security Program Leadership Role | | | | |
| 💼 PM-3 Information Security and Privacy Resources | | | | |
| 💼 PM-4 Plan of Action and Milestones Process | | | | |
| 💼 PM-5 System Inventory | 1 | | 1 | |
|     💼 PM-5(1) System Inventory _ Inventory of Personally Identifiable Information | | | | |
| 💼 PM-6 Measures of Performance | | | | |
| 💼 PM-7 Enterprise Architecture | 1 | | | |
|     💼 PM-7(1) Enterprise Architecture _ Offloading | | | | |
| 💼 PM-8 Critical Infrastructure Plan | | | | |
| 💼 PM-9 Risk Management Strategy | | | | |
| 💼 PM-10 Authorization Process | | | | |
| 💼 PM-11 Mission and Business Process Definition | | | | |
| 💼 PM-12 Insider Threat Program | | | | |
| 💼 PM-13 Security and Privacy Workforce | | | | |
| 💼 PM-14 Testing, Training, and Monitoring | | | | |
| 💼 PM-15 Security and Privacy Groups and Associations | | | | |
| 💼 PM-16 Threat Awareness Program | 1 | | | |
|     💼 PM-16(1) Threat Awareness Program _ Automated Means for Sharing Threat Intelligence | | | | |
| 💼 PM-17 Protecting Controlled Unclassified Information on External Systems | | | | |
| 💼 PM-18 Privacy Program Plan | | | | |
| 💼 PM-19 Privacy Program Leadership Role | | | | |
| 💼 PM-20 Dissemination of Privacy Program Information | 1 | | | |
|     💼 PM-20(1) Dissemination of Privacy Program Information _ Privacy Policies on Websites, Applications, and Digital Services | | | | |
| 💼 PM-21 Accounting of Disclosures | | | | |
| 💼 PM-22 Personally Identifiable Information Quality Management | | | | |
| 💼 PM-23 Data Governance Body | | | | |
| 💼 PM-24 Data Integrity Board | | | | |
| 💼 PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research | | | | |
| 💼 PM-26 Complaint Management | | | | |
| 💼 PM-27 Privacy Reporting | | | | |
| 💼 PM-28 Risk Framing | | | | |
| 💼 PM-29 Risk Management Program Leadership Roles | | | | |
| 💼 PM-30 Supply Chain Risk Management Strategy | 1 | | | |
|     💼 PM-30(1) Supply Chain Risk Management Strategy _ Suppliers of Critical or Mission-essential Items | | | | |
| 💼 PM-31 Continuous Monitoring Strategy | | | | |
| 💼 PM-32 Purposing | | | | |