Risk Management Framework Explained

The Risk Management Framework (RMF) is a United States federal government guideline, standard and process for risk management to help secure information systems (computers and networks) developed by National Institute of Standards and Technology (NIST). The RMF, illustrated in the diagram to the right, provides a disciplined and structured process that integrates information security, privacy and risk management activities into the system development life cycle.^{[1] [2]}

Overview

The main document that describes the details of RMF is NIST Special Publication 800-37, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy".^[1] This is the second revision of this document and supersedes the first revision "Guide for Applying the Risk Management Framework to Federal Information Systems".^[3]

The various steps of the RMF link to several other NIST standards and guidelines, including NIST Special Publication 800-53, "Security and Privacy Controls for Information Systems and Organizations".

The RMF steps include:

• Prepare to execute the RMF by establishing a context and priorities for managing security and privacy risk at organizational and system levels.^{[4] [5]}
• Categorize the information system and the information processed, stored, and transmitted by that system based on an impact analysis.^{[6] [7] [8]}
• Select an initial set of baseline security controls for the information system based on the security categorization; tailoring and supplementing the security control baseline as needed based on an organizational assessment of risk and local conditions. If any overlays apply to the system they will be added in this step.^{[2] [9]}
• Implement the security controls identified in step 2.^[2]
• Assess: a third party assesses the controls and verifies that the controls are properly applied to the system.^[10]
• Authorize: the information system is granted or denied an Authorization to Operate (ATO), in some cases it may be postponed while certain items are fixed. The ATO is based on the report from the Assessment phase. ATO is typically granted up to 3 years and the process needs to be repeated at the end of the period.^[1]
• Monitor the security controls in the information system continuously in a pre-planned fashion as documented earlier in the process.^[5]

History

The Tentrilistic-Government Act of 2002 (Public Law 107-347) entitled FISMA 2002 (Federal Information Security Management Act) was a law passed in 2002 to protect the economic and national security interests of the United States related to information security.

Congress later passed FISMA 2014 (Federal Information Security Modernization Act) to provide improvements over FISMA 2002 by:

• Codifying Department of Homeland Security (DHS) authority to administer the implementation of information security policies for non-national security federal Executive Branch systems, including providing technical assistance and deploying technologies to such systems;
• Amending and clarifying the Office of Management and Budget's (OMB) oversight authority over federal agency information security practices; and by
• Requiring OMB to amend or revise OMB A-130 to "eliminate inefficient and wasteful reporting."^[11]

FISMA required the protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide Confidentiality, Integrity and Availability. Title III of FISMA 2002 tasked NIST with responsibilities for standards and guidelines, including the development of:

• Standards to be used by all federal agencies to categorize all information and information systems collected or maintained by or on behalf of each agency based on the objectives of providing appropriate levels of information security according to a range of risk levels. This task was satisfied by FIPS Publication 199;^[8]
• Guidelines recommending the types of information and information systems to be included in each category. This task was satisfied by NIST Special Publication 800-60, Volumes 1 and 2;^{[6] [7]} and
• Minimum information security requirements (i.e., management, operational, and technical controls), for information and information systems in each such category. This task was satisfied by the development of FIPS Publication 200.^[9]

The NIST 800-37 Risk Management Framework (RMF) is a set of cybersecurity risk management guidelines designed to help organizations manage security and privacy risks and satisfy the requirements of the Federal Information Security Modernization Act of 2014 (FISMA), the Privacy Act of 1974, OMB policies, and Federal Information Processing Standards, among other laws, regulations, and policies.^[1]

Risks

During its lifecycle, an information system will encounter many types of risk that affect its overall security posture and the security controls that must be implemented. The RMF process supports early detection and resolution of risks. Risks can be categorized at a high level as infrastructure, project, application, information asset, business continuity, outsourcing, external and strategic risks. Infrastructure risks focus on the reliability of computers and networking equipment. Project risks focus on budget, timeline and system quality. Application risks focus on performance and overall system capacity. Information asset risks pertain to the potential damage or loss of information assets and unauthorized disclosure of these assets. Business continuity risks involve maintaining a reliable system with maximum uptime. Outsourcing risks revolve around the impact of third-party suppliers meeting their requirements.^[12] External risks are factors beyond the information system's control that can impact the system's security. Strategic risks are associated with the need for information system functions to align with the business strategy that the system supports.^[13]

Revision 2 updates

The major objectives for the update to revision 2 included the following:^[14]

• Provide closer linkage and communication between the risk management processes and activities at the C-suite or governance level of the organization and the individuals, processes, and activities at the system and operational level of the organization;
• Institutionalize critical risk management preparatory activities at all risk management levels to facilitate a more effective, efficient, and cost-effective execution of the RMF;
• Demonstrate how the NIST Cybersecurity Framework can be aligned with the RMF and implemented using established NIST risk management processes;
• Integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible;
• Promote the development of trustworthy secure software and systems by aligning life cycle-based systems engineering processes in NIST SP 800-160 Volume 1,^[15] with the relevant tasks in the RMF;
• Integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC; and
• Allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST SP 800-53 Revision 5.^[2]

Revision 2 also added a new "Prepare" step in position zero to achieve more effective, efficient, and cost-effective security and privacy risk management processes.^[14]

See also

• Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) - predecessor to RMF
• Zero Trust Architecture
• NIST Cybersecurity Framework
• Cyber Risk Quantification
• Outline of computer security

External links

• Risk Management Framework Overview
• RMF Control Indexer
• NIST Cybersecurity Framework (CSF)
• Duty of Care Risk Analysis (DoCRA) Standard - practices to define acceptable levels of risk and establish reasonable security.

Notes and References

1. SP 800-37 Rev. 2 - Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy . 10.6028/NIST.SP.800-37r2 . . December 2018 . Joint Task Force.
2. Joint Task Force . September 2020 . SP 800-53 Rev. 5 - Security and Privacy Controls for Information Systems and Organizations . . 10.6028/NIST.SP.800-53r5.
3. Joint Task Force . February 2010 . SP 800-37 Rev. 1 - Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach . 10.6028/NIST.SP.800-37r1 . NIST.
4. Joint Task Force Transformation Initiative . September 2012 . SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments . 10.6028/NIST.SP.800-30r1 . NIST.
5. Dempsey. Kelley. Chawla. Nirali. Johnson. L.. Johnston. Ronald. Jones. Alicia. Orebaugh. Angela. Scholl. Matthew. Stine. Kevin . September 2011 . 10.6028/NIST.SP.800-137 . SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations . NIST.
6. 10.6028/NIST.SP.800-60v1r1 . Stine. Kevin. Kissel. Richard. Barker. William. Fahlsing. Jim. Gulick. Jessica. August 2008. SP 800-60 Vol. 1 Rev. 1 - Guide for Mapping Types of Information and Information Systems to Security Categories . NIST.
7. Stine. Kevin. Kissel. Richard. Barker. William. Lee. Annabelle. Fahlsing. Jim . August 2008 . SP 800-60 Vol. 2 Rev. 1 - Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices . 10.6028/NIST.SP.800-60v2r1 . NIST.
8. . February 2004 . FIPS 199 - Standards for Security Categorization of Federal Information and Information Systems . 10.6028/NIST.FIPS.199.
9. . FIPS 200 - Minimum Security Requirements for Federal Information and Information Systems . 10.6028/NIST.FIPS.200 . March 2006.
10. Joint Task Force . January 2022 . SP 800-53A Rev. 5 - Assessing Security and Privacy Controls in Information Systems and Organizations . 10.6028/NIST.SP.800-53Ar5 . NIST.
11. Web site: Federal Information Security Modernization Act . . 26 July 2024.
12. IEEE International Conference on Systems, Man and Cybernetics (SMC) . IT risk management framework for business continuity by change analysis of information system . 2012 . Samejima . M. . Yajima . H. . 10.1109/ICSMC.2012.6377977 . 1670-1674.
13. An empirical study on the risk framework based on the enterprise information system . 2009 International Conference on Future BioMedical Information Engineering (FBIE) . 2009 . 187-190 . Zhigang . Ji . 10.1109/FBIE.2009.5405879.
14. Web site: Computer Security Division. Information Technology Laboratory. 2018-12-18. RMF Update: NIST Publishes SP 800-37 Rev. 2 CSRC. 2021-07-26. CSRC NIST. EN-US.
15. Ross. Ron. McEvilley. Michael. Winstead. Mark . November 2022 . SP 800-160 Vol. 1 Rev. 1 - Engineering Trustworthy Secure Systems . 10.6028/NIST.SP.800-160v1r1.