Nist 800 37

NIST SP 800-37 Rev. 2 — Risk Management Framework (RMF)

Source: NIST (US Government work, public domain) | Chapters: 7

When to use

Use this skill to manage security and privacy risk across a system's life cycle the way the federal Risk Management Framework prescribes: preparing the organization and the system, categorizing by impact, selecting and tailoring controls, implementing and assessing them, making an accountable risk-acceptance (authorization) decision, and sustaining that decision through continuous monitoring. It is the governance-and-assurance overlay that wraps an engineered system — the bridge from systems security engineering (nist-sse) and the broader SE life cycle (dau-se-guidebook, nasa-npr-7123) into a defensible, leadership-owned risk decision.

Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.

How to Use This Skill

• Without arguments — load the core frameworks below: the RMF seven steps, the three-tier risk model, authorization boundaries, the requirements-to-controls seam, and the security/privacy distinction.
• With a topic — ask about a step (e.g. "categorize", "authorize"), a task ID (e.g. "P-11", "S-2", "R-4", "M-6"), or a construct (authorization boundary, high-water mark, common control, POA&M, ongoing authorization, supply chain risk).
• With a chapter — ch03 (Prepare), ch04 (Categorize + Select), ch05 (Implement + Assess), ch06 (Authorize), ch07 (Monitor).

Supporting files: glossary.md, patterns.md, cheatsheet.md.

What the RMF is — and isn't. SP 800-37 Rev. 2 is a risk-management process for information systems, not a general SE process model. It rides alongside the SDLC and the ISO/IEC/IEEE 15288 / SP 800-160 life cycle rather than replacing them. Read this pack as the security-and-privacy-risk overlay on top of engineering work, not the engineering itself.

Core Frameworks & Mental Models

The Risk Management Framework (RMF) — seven steps

The RMF is a repeatable, life-cycle, risk-based process developed by NIST with the Department of Defense, ODNI, and CNSS. It builds protection into systems, sustains posture through continuous monitoring, and surfaces risk information to senior leaders for acceptance decisions. It is one preparatory step plus six main steps:

1. Prepare — establish context and priorities at both the organization and system levels: roles, risk management strategy and tolerance, common controls, tailored baselines, authorization boundaries, and requirements. (ch03)
2. Categorize — determine the system's impact level from the consequences of losing confidentiality, integrity, or availability. (ch04)
3. Select — choose an initial control set, then tailor it to reduce risk to an acceptable level; allocate, document, and set monitoring. (ch04)
4. Implement — put the planned controls into the system and record the as-built configuration. (ch05)
5. Assess — determine whether each control was built correctly, runs as intended, and yields the outcome the requirements demand. (ch05)
6. Authorize — a senior official accepts (or refuses) residual risk to operations, assets, individuals, other organizations, and the Nation. (ch06)
7. Monitor — sustain ongoing situational awareness of posture, supporting near-real- time risk management and ongoing authorization. (ch07)

After Prepare, the steps may run non-sequentially — driven by system type, leadership risk decisions, agile/iterative cycles, or changes surfaced during Monitor. An organization can enter or re-enter at whichever step a current risk assessment dictates. The one invariant: the authorizing official explicitly accepts risk before operation.

Each task has a defined anatomy — potential inputs, expected outputs, primary and supporting responsibilities, the SDLC phase, a discussion, and references — and those references identify the correlated systems-security-engineering tasks. That is the explicit RMF-to-SE bridge.

The three-tier organization-wide risk model (from SP 800-39)

Risk lives at three levels, with risk information flowing across all three:

• Level 1 — organization (risk strategy, tolerance, governance).
• Level 2 — mission/business process (prioritized missions, enterprise and security/privacy architecture, common controls).
• Level 3 — information system (the system's own risk, guided and constrained by the upper tiers).

Risk gravity flows downhill: strategy, tolerance, architecture, and boundary decisions made above fall onto the system tier and constrain the controls selected there. Getting the upper-tier groundwork right (the "Prepare" work) is what makes system-level risk work affordable, repeatable, and effective.

Authorization boundary

The authorization boundary defines the system for RMF purposes: the set of system elements (people, processes, technologies) authorized for operation — or the set of common controls authorized for inheritance. It replaces the older term "system boundary." Size it as a deliberate trade-off: too wide adds needless complexity, too narrow multiplies separately managed systems and inflates cost. Group elements that share mission, requirements, information impact level, and environment of operation, under common direct management. Each piece of the environment is either in scope (its protections land in your plan) or inherited as common controls.

Requirements → controls → engineering (the SE seam)

Requirements (legal/policy obligations and, more broadly, stakeholder protection needs) drive controls — descriptions of safeguards and protection capabilities. Controls in turn decompose into specification and statement-of-work requirements that engineers build, derive, and test. This is the seam where the RMF meets systems-engineering requirements practice (SP 800-160 v1 / ISO/IEC/IEEE 15288). Controls are designated system-specific, common (inherited), or hybrid, and allocated only to the elements that need the capability.

Security and privacy: distinct but collaborating

Information security protects confidentiality, integrity, and availability. Privacy programs manage risk to individuals from the processing of PII. The crucial asymmetry: not all privacy risk comes from unauthorized activity — some arises from fully authorized processing — so securing PII does not by itself protect privacy. Controls meeting both objectives are simply "controls"; the qualifiers are used only when a control is selected for a particular objective. Privacy entered the RMF via OMB Circular A-130 (2016).

Posture, authorization, and residual risk

Posture — the current status of systems and resources given the defenses in place — is built from ongoing assessment of system-specific, hybrid, and common controls. It is the evidence base the authorizing official reads to judge whether residual risk is acceptable against the organization's risk tolerance. Residual risk always remains; the job is to land it inside tolerance and write down what was accepted. Risk acceptance cannot be delegated — it is one named senior official's accountability, and the one RMF step an external provider can never perform.

Continuous monitoring and ongoing authorization

Monitor turns a one-time authorization into a continuously re-evidenced one. A robust, mature continuous monitoring program lets the organization replace a fixed authorization termination date with a time-driven re-judgment frequency — ongoing authorization — supporting near-real-time risk management. Independence-qualified assessment results can be reused for ongoing authorization, reauthorization, and the annual FISMA requirement.

Supply chain risk management (SCRM)

External providers and COTS components carry risk inside your boundary, so the RMF folds SCRM in rather than treating it as a parallel track. Single-use acceptable can become systemic-unacceptable when an element is everywhere. Every RMF step can be executed by a nonfederal external provider except Authorize — risk acceptance stays a federal responsibility, and the obtainable assurance depends on the degree of control (contract / SLA terms) and the evidence of control effectiveness the provider supplies.

Chapter Index

Topic Index

• Assess step / assessment report → ch05
• Assessment criterion (correct / operating / effective) → ch05
• Assurance → ch05, ch03
• Authorization boundary → ch02, ch03
• Authorization package → ch06
• Authorization types (operate / use / common control) → ch06
• Authorize step / risk acceptance → ch06
• Authorizing official → ch06
• Categorize step → ch04
• Common control / inheritance → ch03, ch04
• Continuous monitoring strategy → ch07, ch04
• Control selection → ch04
• High-water mark → ch04
• Hybrid control → ch03, ch04
• Impact level → ch04
• Implement step → ch05
• Information system (definition) → ch01
• Monitor step → ch07
• Ongoing authorization → ch06, ch07
• Plan of Action and Milestones (POA&M) → ch05, ch06
• Posture (security and privacy) → ch02
• Prepare step → ch03
• Privacy risk / security-privacy distinction → ch01, ch02
• Reciprocity → ch01
• Requirements and controls → ch02, ch03
• Residual risk → ch06
• Reuse of assessment evidence → ch05, ch07
• Risk Management Framework (RMF) → ch01, ch02
• Risk tolerance / risk management strategy → ch03
• Select step / tailoring → ch04
• Supply chain risk management (SCRM) → ch02
• System elements / components → ch02, ch03
• System disposal → ch07
• Three-tier risk model → ch02
• Vulnerability vs. finding → ch05

Supporting Files

• glossary.md — key RMF terms, alphabetical, with chapter references
• patterns.md — operating patterns (RMF-as-SDLC-overlay, maximizing common controls, sizing the boundary, baseline vs. organization-generated, shift-left assessment and reuse, routing deficiencies, ongoing authorization, disposal as a risk event) with When / How / Trade-offs
• cheatsheet.md — the seven steps and tasks, the three-part assessment test, categorize roll-up table, baseline-vs-organization-generated table, control allocation, deficiency routing, authorization types, dated-vs-ongoing authorization, tells & smells, and the RMF-to-SE seams

Scope & Limits

Covers: the Risk Management Framework per NIST SP 800-37 Revision 2 — the seven steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) and their tasks (P-1…P-18, C-1…C-3, S-1…S-6, I-1…I-2, A-1…A-6, R-1…R-5, M-1…M-7); the three-tier organization-wide risk model; authorization boundaries; the requirements-to-controls relationship; security categorization and control selection/tailoring at the process level; assessment, the authorization decision and risk acceptance; continuous monitoring and ongoing authorization; the security/privacy distinction; and supply chain risk management as the RMF folds it in.

Does not cover in depth: the SP 800-53 control catalog and its SP 800-53B baselines (the RMF selects from them — they are named and routed to, not reproduced); the FIPS 199 / FIPS 200 / CNSSI 1253 impact tables (the categorization scheme is described, the tables are not restated); the ISO/IEC/IEEE 15288 process definitions (third-party copyrighted — see se-standards-signpost; for open SE process models use dau-se-guidebook / nasa-npr-7123); the detailed continuous-monitoring mechanics of SP 800-137, risk-assessment methodology of SP 800-30, SCRM practice of SP 800-161, and privacy engineering of IR 8062 (all referenced, not reproduced); and the systems- security-engineering practice beneath the RMF (see nist-sse for SP 800-160). The RMF governs how much protection and whether to accept residual risk; those companions govern how protection is built.

Source version: NIST SP 800-37 Revision 2 — the RMF publication, subtitled a system-life-cycle approach to security and privacy for information systems and organizations (December 2018).

Jurisdiction: US Government public domain work. The framework is mandatory for federal information systems and voluntary (but broadly adoptable) for state, local, tribal, and private-sector organizations.