NIST SP 800-37 Rev. 2

Purpose, scope and authority

RMF connects organisational risk decisions to individual systems and common controls. Its seven steps can interact and repeat as the system changes. The publication addresses security and privacy throughout the lifecycle. Its federal context matters: do not assume that all organisations, countries or national-security systems inherit the same authority or obligations. [1]

Principles and operating logic [1]

1. Prepare

Establish risk roles, strategy, priorities, system boundaries and the context needed to execute the process. Identify common controls and organisational constraints early so that system teams do not invent incompatible assumptions.

2. Categorize

Determine the impact of information and system loss using the applicable categorisation approach. Record the information types and reasoning. Categorisation concerns consequences; it is not a count of vulnerabilities or a substitute for risk assessment.

3. Select

Choose and tailor the controls appropriate to the system and applicable baseline. Specify responsibilities, parameters and monitoring arrangements. Document why an inherited, system-specific or hybrid implementation is appropriate.

4. Implement

Put the selected controls into operation and describe how they work in the actual environment. Record implementation details and deviations so that an assessor can evaluate the real system rather than an aspirational design.

5. Assess

Evaluate whether controls are implemented correctly, operate as intended and produce the desired outcomes. Plan the assessment, obtain evidence, report findings and address deficiencies. Determine the necessary assessor independence in context.

6. Authorize

Provide the authorising official with the risk information needed for an accountable decision about operation or common-control use. The decision may carry conditions. An assessment report informs acceptance; the assessor does not automatically become the risk owner.

7. Monitor

Track controls, changes, deficiencies and risk over time. Update the relevant plans and authorisation information. A significant change can invalidate earlier assumptions even while the previous documentation remains formally complete.

Application · editorial recommendations

Start by identifying the decision authority and system boundary. Build a traceable chain from categorisation through control selection, implementation, assessment and residual-risk decision. Common controls can reduce duplicated effort, but inheritance must be evidenced and its limitations understood. Tie review to meaningful changes in mission, architecture, threat and control performance.

Evidence for the CISO · proposed review pack

Our suggested decision pack includes security/privacy plans, assessment results, unresolved findings, a plan of action and milestones, and the conditions attached to authorisation. Name each treatment owner and date. In a hypothetical outsourced identity service, distinguish what the provider supplies from the customer’s own account administration and incident responsibilities.

Common mistakes and limits

Do not reduce RMF to paperwork at the end of a project, treat authorisation as permanent, or assume a supplier attestation automatically covers the whole system. The official tasks contain more detailed inputs, outcomes and responsibilities; use them when establishing the organisation’s actual process.

Official sources and reading route

Read these sections in the source: Chapter 3; Appendices D–F.

1. NIST SP 800-37 Rev. 2 · 2018-12 · Risk Management Framework