1. Home
  2. NIST References
  3. PM-1

PM-1 - Information Security Program Plan

a. Develop and disseminate an organization-wide information security program plan that: 1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements; 2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance; 3. Reflects the coordination among organizational entities responsible for information security; and 4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; b. Review and update the organization-wide information security program plan [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and c. Protect the information security program plan from unauthorized disclosure and modification.


ID: PM-1
Enhancements: 

Space Segment Guidance

A rigorous information security program plan tailored to a space mission’s lifecycle serves as the foundation for managing risk effectively across ground stations, launch facilities, and on-orbit assets. In practice, this plan outlines organizational roles—like mission directors, cybersecurity specialists, and propulsion engineers—ensuring that each stakeholder understands the responsibilities tied to protecting spacecraft data and commands. The plan should detail decision-making authorities for approving software patches or cryptographic updates, define processes for supply chain vetting (e.g., third-party hardware modules), and describe escalation pathways for responding to anomalies, be they environmental events or adversarial actions. Additionally, the plan fosters continuous improvement via periodic assessments and lessons learned from prior missions, creating a structured framework that unifies engineering best practices, regulatory obligations (e.g., CNSSP №12), and the organization’s broader security strategy into a coherent whole.