Execute the NIST Risk Management Framework (RMF) Essentials

Understand the seven RMF steps—prepare, categorize, select, implement, assess, authorize, monitor—in a continuous life cycle that maintains ongoing awareness, accountability, and improvement of security controls.

Align organizational strategic readiness and system level tactical readiness through the RMF 2.0 prepare step, establishing governance, risk tolerance, roles, and common controls to streamline categorization and authorization.

Define roles and governance in the prepare step to ensure accountability and senior leadership engagement. Align cybersecurity with enterprise architecture, prioritize high impact assets, and establish a risk management strategy.

RMF 2.0's prepare step aligns organizational and system levels, guiding risk tolerance, governance, and the preparation of system boundaries and artifacts for control selection.

Determine security categorization through a structured, risk-based process per FISMA and NIST SP 860 to guide selecting controls based on CIA impact levels for system function and data types.

Explore how FIPS 199 defines confidentiality, integrity, and availability, and how SP 860 maps data types to impact levels, ensuring consistent, justified RMF categorizations.

Align risk with protection by selecting controls in the RMF, using SP 853 baselines and tailoring to the system’s categorization, impact level, and mission needs.

Tailor and scope baseline controls to your system, guided by risk, threat intelligence, and hosting environment, and document decisions with rationale and references to overlays.

Explore NIST SP 853 as a comprehensive catalog of security and privacy controls used in the RMF to select, tailor, and implement baseline controls across control families.

Document how a control will be implemented within the RMF context to provide accountability, traceability, and a clear view of risk addressed for stakeholders. Documentation feeds the system security plan.

Explore how security control inheritance lets systems reuse common controls, such as firewalls and patching, reducing redundancy and cost while ensuring consistent security in the system security plan.

Assess security controls to verify they are implemented as described and effectively reducing risk, using examination, interviews, and testing to produce the security assessment report for authorization and continuous monitoring.

Outline the security assessment plan as a blueprint for scope, assessment methods, controls, roles, rules of engagement, and timeline, with the security assessment report documenting findings and remediation.

The security control assessor independently evaluates controls by gathering evidence from system documentation, interviews, tests, and observations, collaborates with system owner, ESO, and authorizing official to determine authorization to operate.

Authorize operations by the authorizing official evaluating security and residual risk against risk tolerance, using evidence from security assessment report, plan of action and milestones, and ssp to decide ATO.

Risk acceptance occurs when the authorizing official approves residual risk after balancing security controls, mission value, and threat context, with clear documentation and conditional safeguards guiding decisions.

Learn how authorizing officials determine operation readiness through risk-based decisions, including full ATO, conditional denials, and ongoing authorization with continuous monitoring.

Continuous monitoring detects configuration changes, user behavior, and vulnerabilities, enabling near real-time risk response and ongoing compliance evidence for RMF authorizing officials.

Timely, clear reporting informs stakeholders and enables proactive risk response within the RMF. Use continuous monitoring and threat intel to apply mitigation, acceptance, transfer, or avoid, updating RMF artifacts.

Integrate RMF across the information system life cycle—from initiation and planning through decommissioning—building security in, detailing SSP controls, and enabling continuous monitoring and secure retirement.

Identify RMF stakeholders from system owner to assessor and learn how collaboration among AOE, ATO, ISO, SCA, and SSE drives risk decisions, controls, and lifecycle security.

Collaborate across the rmf lifecycle from prepare and categorize to continuous monitoring, aligning system owner, information owner, risk executive, eso, and authorizing official with sca.