What does PM-1 Information Security Program Plan document?

• A. The plan documents the org-wide program management controls and org-defined common controls
• B. The plan defines system-specific configurations for each information system
• C. The plan contains incident response procedures and communication protocols
• D. The plan sets data encryption standards for all data at rest and in transit

Answer: (A)

PM-1 centers on how the organization governs information security across the entire enterprise. It documents the program management controls that apply organization-wide and defines the common controls the organization selects and implements centrally so multiple systems can rely on them. This enterprise-wide plan sets the baseline for risk management, governance, and ongoing oversight, rather than detailing system-specific configurations, incident response procedures, or encryption standards which belong to system-specific plans or separate policy documents.