The program management offices is aligning security impact levels with new NIST guidance on security and privacy controls.