NIST SP 800-37 Rev. 2 — Risk Management Framework (RMF)

Why does it matter?

The RMF is the process federal agencies must follow to put a system into operation and keep it there. Section 1.1 cites OMB Circular A-130 as the policy that requires agencies to implement it, and the Authorize step gives the decision a named owner: a senior official who determines whether the security and privacy risk, including supply chain risk, from operating the system is acceptable (Section 3.6). Each task in Chapter Three states its expected outputs, the primary responsibility and the supporting roles, and the outcome tables map the tasks to NIST Cybersecurity Framework subcategories, so the framework is executable as a checklist rather than a set of principles.

Key benefits include:

• One process for security and privacy

Section 2.3 and the A-130 text quoted in Section 1.1 require the two programs to collaborate; the plans, assessment reports and authorization package cover both.

• Preparation before categorization

Tasks P-1 to P-18 set roles, the risk management strategy, organization-wide risk assessment, tailored baselines, common controls and the continuous monitoring strategy before any system is categorized.

• A defined authorization package

Task R-1 names the package: security and privacy plans, assessment reports, the plan of action and milestones and an executive summary.

• Ongoing rather than periodic authorization

Appendix F defines ongoing authorization as follow-on risk determinations made with continuous monitoring results, and Task M-6 makes it a Monitor-step task.

• Supply chain in scope

Section 2.8 brings supply chain risk management into the RMF, and the Authorize purpose statement counts supply chain risk in the risk the authorizing official accepts.

How does it work?

Chapter Two gives the fundamentals: organization-wide risk management across the three levels of organization, mission/business process and system (Section 2.1); the seven steps and their structure (2.2); information security and privacy in the RMF (2.3); systems and system elements (2.4); authorization boundaries (2.5); requirements and controls (2.6); security and privacy posture (2.7); and supply chain risk management (2.8). Chapter Three gives every task with a task statement, potential inputs, expected outputs, primary responsibility, supporting roles, the system development life cycle phase and a discussion, with references to the supporting NIST publications.

The Prepare step has two parts. The organization-level tasks assign risk management roles (P-1), establish the risk management strategy (P-2), run an organization-wide risk assessment (P-3), publish organizationally tailored control baselines and Cybersecurity Framework profiles (P-4), identify common controls (P-5), prioritize systems of the same impact level (P-6) and set the continuous monitoring strategy (P-7). The system-level tasks identify the mission the system supports, its stakeholders, assets, authorization boundary, information types and information life cycle (P-8 to P-13), run the system-level risk assessment (P-14), define and allocate requirements (P-15, P-17), place the system in the enterprise architecture (P-16) and register it (P-18).

The six main steps then follow the system through its life. Categorize documents the system and approves its security categorization (C-1 to C-3). Select chooses, tailors and allocates controls, documents them in security and privacy plans, sets a system-level monitoring strategy and gets the plans approved (S-1 to S-6). Implement puts the controls in place and records the as-implemented state (I-1, I-2). Assess selects the assessor, approves the assessment plan, assesses the controls, reports, remediates and prepares the plan of action and milestones (A-1 to A-6). Authorize assembles the package, analyzes the risk, chooses a response, makes the decision and reports it (R-1 to R-5). Monitor covers changes, ongoing assessments and risk response, package updates, reporting, ongoing authorization and system disposal (M-1 to M-7).

Key Elements

• Seven steps (Section 2.2)

A preparatory step, Prepare, and six main steps: Categorize, Select, Implement, Assess, Authorize and Monitor. All seven are essential to executing the RMF.

• Tasks and outcomes (Chapter Three, Tables 1 to 8)

Each step has numbered tasks with expected outcomes; Appendix E summarizes them with responsibilities and supporting roles (Tables E-1 to E-7).

• Roles (Appendix D)

Authorizing official, risk executive (function), senior agency information security officer, senior agency official for privacy, system owner, common control provider, control assessor, information owner or steward, enterprise architect and others, each with responsibilities.

• Authorization decisions (Appendix F)

Authorization to operate, common control authorization, authorization to use and denial of authorization; plus initial and ongoing authorization, reauthorization and event-driven triggers.

• Authorization boundaries (Section 2.5 and Appendix G)

Task P-11 determines the boundary; Appendix G discusses boundaries for complex systems, external providers and software applications.

• System life cycle (Appendix H)

The tasks are tied to SDLC phases, aligning with the systems engineering processes of SP 800-160 Volume 1, one of the seven objectives of the update.

• Cybersecurity Framework alignment

The outcome tables map tasks to CSF subcategories (for example Task M-1 to DE.CM and ID.GV), and Task P-4 allows CSF profiles as organizationally tailored baselines.

What does it cover?

SP 800-37 Rev. 2 applies to federal information systems, defined in Section 1.2 as discrete sets of information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of information, whether digital or not. A federal information system includes one operated by a contractor or another organization on behalf of an agency. The guidelines complement those for national security systems and may be used for them with the approval of officials with policy authority; state, local and tribal governments and private sector organizations are encouraged to use them. The RMF project page states that the approach applies to new and legacy systems and any type of system or technology in any organization regardless of size or sector.

What are its objectives?

Section 1.2 lists what the guidelines were developed to do:

Keep system-related security and privacy risk management consistent with the organization's mission and business objectives and the risk management strategy set by senior leadership through the risk executive (function).

Achieve privacy protections for individuals and security protections for information and systems through appropriate risk response strategies.

Support consistent, informed and ongoing authorization decisions, reciprocity, and the transparency and traceability of security and privacy information.

Integrate security and privacy requirements and controls into the enterprise architecture, SDLC, acquisition and systems engineering processes.

Facilitate the implementation of the Cybersecurity Framework within federal agencies.

Through the Prepare step, reduce complexity, identify common controls and tailored baselines, and focus resources on high value assets (Executive Summary).

Framework in Context

The RMF draws its inputs from the rest of the NIST risk management series. SP 800-39 supplies the three-level view and the frame, assess, respond and monitor components that Section 2.1 builds on; SP 800-30 Rev. 1 provides the risk assessment method used in Tasks P-3 and P-14; SP 800-53 Rev. 5 is the control catalog selected from in Task S-1, with the baselines in SP 800-53B, and SP 800-53A gives the assessment procedures of Task A-3. The seventh objective of the update allows an organization-generated control selection approach alongside baseline selection. The RMF project page publishes quick start guides for each step, for roles and responsibilities and for small enterprises.

Common Framework Mappings

NIST SP 800-37 Rev. 2 is commonly mapped to the control catalogs it selects from, the authorization programs built on it and the management system standards that cover the same life cycle.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Rev. 5

ISO 27001:2022

ISO 27002:2022

ISO 27701

NIST CSF 2.0

NIST SP 800-30 Rev. 1

NIST 800-53 Rev.5