{"data":{"id":"PS-09","name":"Position Descriptions","family":"PS","family_name":"Personnel Security","withdrawn":false,"description":"Incorporate security and privacy roles and responsibilities into organizational position descriptions.","supplemental_guidance":"Specification of security and privacy roles in individual organizational position descriptions facilitates clarity in understanding the security or privacy responsibilities associated with the roles and the role-based security and privacy training requirements for the roles.","enhancements":[],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"PS-09","name":"Position Descriptions","description":"Incorporate security and privacy roles and responsibilities into organizational position descriptions.","discussion":"Specification of security and privacy roles in individual organizational position descriptions facilitates clarity in understanding the security or privacy responsibilities associated with the roles and the role-based security and privacy training requirements for the roles.","related_controls":[],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":null,"new_in_rev5":true,"changes_from_rev4":"New control in Rev 5."}},"compliance_mappings":{"iso_27001_2022":["5.3","A.5.2","A.6.2"],"iso_27002_2022":["5.2","6.2"],"cobit_2019":["APO07"],"pci_dss_v4":[],"nist_csf_2":["GV.RR-02","GV.RR-04"],"cis_controls_v8":[],"soc2_tsc":["CC1.4","CC1.5"],"finos_ccc":[],"iso_42001_2023":["A.2.3","A.3.2"],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 16-17","Para 18"],"mas_trm":["3"],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.2","ORP.2"],"anssi":["Hygiene.4","Hygiene.7","Hygiene.11","SecNumCloud.8.1"],"osfi_b13":["B-13.1.1"],"finma_circular":["IV.B.a(48)","IV.B.d(60)"],"gdpr":["Art.29","Art.32(4)","Art.37(1)","Art.39(1)"],"dora":["Art.5(4)"],"bio2":["5.2","6.2"],"rbi_csf":["ITGRCA.8","ITGRCA.24"],"fisc":["FISC.O8"],"lgpd_bcb":["BCB.Art.17","BCB.Art.17-Supp","LGPD.Art.41","LGPD.Art.47"],"hkma_tme1":["TME1.2.1","TME1.2.4"],"mlps_2":[],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"cbb_tm":["TM-1"],"cbuae":["CR-1"],"nca_ecc":["1-4","1-9"],"qatar_nia":["GV","HR"],"sama_csf":["1.1","1.5","1.7"],"uae_ia":["T1","T5"],"bog_cisd":["CISD-II","CISD-XV"],"bom_ctrm":["1.1","1.2"],"cbe_csf":["GOV-1","GOV-2"],"cbn_csf":["Part1.1","Part1.2"],"popia":["s55","s56"],"sa_js2":["JS2-4"],"bot_cyber":["Ch1.1","Ch7.2"],"cpmi_pfmi":["CG.GOV"],"ecb_croe":["CROE.2.1.2"],"ffiec_is":["II.C.7","II.C.7(a)"],"iosco_cyber":["GOV-4"],"sebi_cscrf":["GV.RR"],"cmmc_2":["PS"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":["SYSC 13.6.1","SYSC 13.6.3","SYSC 13.G.1"],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":["6.1","6.2"],"lloyds_ms":["CRM.1","GOV.1","MS8.1"],"naic_ds":[],"nhs_dspt":["NDG-1.2"],"pra_ss1_23":["P2.4"],"solvency_ii":["Art.42","DR.258"],"owasp_masvs_v2":[],"csa_ccm_v4":["HRS-10"],"csa_aicm":["HRS-10"],"ccss_v9":[],"mica":["Art.34(1)","Art.54(1)"],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-018"]}}