{"data":{"id":"PM-29","name":"Risk Management Program Leadership Roles","family":"PM","family_name":"Program Management","withdrawn":false,"description":"a. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and\nb. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.","supplemental_guidance":"The senior accountable official for risk management leads the risk executive (function) in organization-wide risk management activities.","enhancements":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"PM-29","name":"Risk Management Program Leadership Roles","description":"a. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and\nb. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.","discussion":"The senior accountable official for risk management leads the risk executive (function) in organization-wide risk management activities.","related_controls":["PM-02","PM-19"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":true,"changes_from_rev4":"New control in Rev 5. Risk management leadership formalized."}},"compliance_mappings":{"iso_27001_2022":["5.1","5.2","5.3","9.3","A.5.2","A.5.4"],"iso_27002_2022":["5.4"],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["GV.RR-01","GV.RR-02"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":["SS1/21-3.2"],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":["5.4"],"rbi_csf":["Annex1.11","ITGRCA.10"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":["TME1.2.1","TME1.2.4"],"mlps_2":[],"dnb_good_practice":["DNB.5.1"],"cra":[],"swift_cscf":[],"cbb_tm":["TM-1"],"cbuae":["CR-1"],"nca_ecc":["1-1","1-2","1-4"],"sama_csf":["1.1","1.8"],"uae_ia":["T1"],"bog_cisd":["CISD-II"],"bom_ctrm":["1.1","1.2"],"cbe_csf":["GOV-1","GOV-2"],"cbn_csf":["Part1.1","Part1.2"],"sa_js2":["JS2-4"],"bcbs_239":["Principle 1"],"cpmi_pfmi":["CG.GOV","PFMI.P2"],"eba_ict":["3.2.1","3.3.1"],"ecb_croe":["CROE.2.1.1","CROE.2.1.2"],"ffiec_is":["I.B"],"nydfs_500":["500.4"],"sebi_cscrf":["GV.RM"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":["CBEST.1"],"tiber_eu":["TIBER.PREP"],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":["SYSC 13.1-2","SYSC 13.6.3","SYSC 13.G.1"],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":["6.1"],"lloyds_ms":["CRM.1","GOV.1","MS8.1","MS10.1"],"naic_ds":["4C"],"nhs_dspt":["NDG-1.2"],"pra_ss1_23":["P2.1"],"solvency_ii":["Art.41(1)","Art.44(1)","DR.258","DR.260","EIOPA-ICT-4.1"],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings extracted from framework-coverage data 2026-10-03: iso_27001_2022 5.2, 5.3, 9.3, A.5.2 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 GV.RR-01, GV.RR-02 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-018"]}}