NIST Risk Management Framework Guide

The NIST Risk Management Framework (RMF) is the process US federal agencies use to manage security and privacy risk for their information systems. Defined in NIST Special Publication 800-37 Revision 2, it takes a system from initial preparation through categorisation, control selection, implementation and assessment, to a formal decision to authorise operation and ongoing monitoring. If you build or host systems for the US government, you will work within it.

The RMF connects a family of NIST publications: FIPS 199 for categorisation, SP 800-53 for controls, SP 800-53A for assessment and SP 800-137 for continuous monitoring. It also underpins FedRAMP for cloud services. This guide explains each of the seven steps, the roles involved, how authorization decisions work, how continuous monitoring keeps systems in check, and how the RMF relates to the Cybersecurity Framework and contractor programmes.

What is the NIST RMF?

The RMF provides a disciplined, structured and flexible process for managing security and privacy risk, including information security categorisation, control selection, implementation and assessment, system and common control authorizations, and continuous monitoring. Revision 2, published in December 2018, added the Prepare step, integrated privacy risk management, aligned with the Cybersecurity Framework, added supply chain risk management, and supported the move to SP 800-53 Revision 5. It is required for federal agencies by OMB Circular A-130 and supports compliance with FISMA.

Who uses it?

US federal agencies, for every federal information system.
Department of Defense components, through DoD's RMF implementation.
Cloud service providers pursuing FedRAMP, which is built on the RMF and SP 800-53 baselines.
Contractors operating systems on behalf of agencies.
State, local and private organisations that adopt it voluntarily as a rigorous model.

Is it mandatory or voluntary?

Mandatory for federal agencies and their systems. For others it is voluntary, but it becomes a contractual requirement for many government projects. There is no certification; instead, an authorizing official grants an authorization to operate (ATO).

The seven steps

Step	Purpose	Key outputs
1. Prepare	Set the organisational and system context and priorities for managing risk.	Risk management roles and strategy, organisation-wide tailored baselines, common controls, system boundary, stakeholders, asset identification.
2. Categorize	Determine the impact of loss of confidentiality, integrity and availability.	System description and security categorisation (Low, Moderate, High) using FIPS 199 and SP 800-60.
3. Select	Choose and tailor controls.	Control baseline from SP 800-53B, tailored controls, allocation to system elements, continuous monitoring strategy, security and privacy plans.
4. Implement	Put controls in place and document how.	Implemented controls and updated plans reflecting actual implementation.
5. Assess	Determine whether controls are implemented correctly, operating as intended and producing desired outcomes.	Assessment plan, security and privacy assessment reports, plan of action and milestones (POA&M).
6. Authorize	Provide accountability by having a senior official decide whether the risk is acceptable.	Authorization package and decision.
7. Monitor	Maintain ongoing situational awareness of security and privacy posture.	Monitoring results, updated plans and reports, ongoing authorization decisions.

Step 1: Prepare

Revision 2 added Prepare to make sure organisations set up risk management before working on individual systems. At organisation level, this includes assigning roles, establishing a risk management strategy and risk tolerance, conducting organisation-wide risk assessment, defining tailored control baselines and common controls, prioritising systems, and developing a continuous monitoring strategy. At system level, it includes defining the mission or business functions the system supports, stakeholders, assets, the authorization boundary, information types, the system's place in the enterprise architecture, and requirements.

Step 2: Categorize

Using FIPS 199 and SP 800-60, the organisation identifies the types of information the system processes and assigns a potential impact level of Low, Moderate or High to each of confidentiality, integrity and availability. The overall system categorisation is usually the highest of these (the "high water mark"). Categorisation drives the control baseline, so it should be reviewed and approved by the authorizing official or designated representative.

Step 3: Select

The organisation selects the initial control baseline from SP 800-53B matching the categorisation, then tailors it: identifying common controls inherited from the organisation or a cloud provider, applying scoping considerations, selecting compensating controls, assigning values to organisation-defined parameters, and adding controls where risk requires. Controls are allocated to system elements, and the system security and privacy plans document the selection and rationale. A continuous monitoring strategy for the system is also defined here.

Step 4: Implement

Controls are implemented as described in the plans, following security and privacy engineering practices, and the plans are updated to reflect how controls were actually implemented. Good implementation descriptions name specific technologies, configurations and procedures, which makes assessment more efficient.

Step 5: Assess

An independent assessor, or assessment team with appropriate independence for the impact level, develops an assessment plan using SP 800-53A procedures, assesses the controls through examination, interviews and testing, and produces security and privacy assessment reports. The system owner may perform initial remediation, and remaining weaknesses go into the plan of action and milestones (POA&M) with milestones and dates.

Step 6: Authorize

The authorizing official (AO), a senior official with authority and accountability, reviews the authorization package (plans, assessment reports and POA&M), determines the risk to organisational operations, assets, individuals and the nation, and decides whether the risk is acceptable. Possible decisions are an authorization to operate, an authorization with conditions, or a denial. Organisations can also issue common control authorizations and type authorizations for systems deployed in multiple locations. The decision is documented and reported.

Step 7: Monitor

After authorization, the organisation monitors the system and its environment for changes, conducts ongoing assessments according to the monitoring strategy, responds to findings, updates plans and reports, and reports security and privacy posture to officials. SP 800-137 describes information security continuous monitoring (ISCM). With mature continuous monitoring, organisations can move to ongoing authorization, where the AO's decision is maintained through continuous evidence instead of periodic reauthorization. When a system is retired, the Monitor step includes decommissioning tasks.

Privacy in the RMF

Revision 2 integrates privacy risk management throughout the process. The senior agency official for privacy shares responsibility with security officials, privacy controls from SP 800-53 Rev. 5 are selected alongside security controls using the privacy baseline in SP 800-53B, and a privacy plan and privacy assessment are part of the authorization package for systems that process personally identifiable information. This reflects the view that a system can be secure yet still create privacy risk, for example through excessive collection or unexpected sharing, and that both must be weighed in the authorization decision.

Supply chain risk in the RMF

Revision 2 also brings supply chain risk management into the framework. Organisations consider risks from suppliers, developers and service providers when preparing, selecting controls and monitoring, drawing on the SR (supply chain risk management) control family in SP 800-53 Rev. 5 and the guidance in SP 800-161. For software and cloud vendors, this means agencies may ask about development practices, component provenance, software bills of materials and the security of subcontractors, and expect these to be documented in the security plan.

Key roles

Head of agency and senior accountable official for risk management.
Chief information officer and senior agency information security officer.
Senior agency official for privacy.
Authorizing official, who accepts risk and grants authorization.
System owner, responsible for the system throughout its life cycle.
Common control provider, responsible for controls inherited by multiple systems.
Control assessor, who assesses controls with appropriate independence.
System security officer and privacy officer, who support day-to-day implementation.

Supporting NIST publications

Publication	Role in RMF
FIPS 199 and FIPS 200	Security categorisation and minimum security requirements.
SP 800-60	Mapping information types to impact levels.
SP 800-53 Rev. 5	Security and privacy control catalogue.
SP 800-53B	Low, Moderate, High and privacy control baselines.
SP 800-53A	Assessment procedures.
SP 800-137	Continuous monitoring.
SP 800-30	Risk assessment guidance.
SP 800-161	Supply chain risk management.

RMF and the Cybersecurity Framework

The RMF and CSF are complementary. The CSF provides a high-level, outcome-based view for organisations to communicate cybersecurity posture and priorities. The RMF provides the detailed, system-level process to select, implement, assess and authorise controls. Revision 2 shows how CSF profiles can inform the Prepare step and how RMF outputs support CSF outcomes.

How contractors and cloud providers work with RMF

For a SaaS or cloud provider selling to federal agencies, FedRAMP applies the RMF to cloud services: providers categorise their service, implement the FedRAMP baseline of SP 800-53 controls, are assessed by a third-party assessment organisation, and receive an authorization that agencies can reuse, then perform continuous monitoring. For defence contractors handling Controlled Unclassified Information on their own systems, the requirements come mainly through NIST SP 800-171 and CMMC rather than full RMF, but systems operated on behalf of DoD follow DoD's RMF process.

How to prepare, step by step

Understand the customer's process: agency RMF, DoD RMF or FedRAMP.
Define the system boundary and inventory components and data flows.
Categorise using FIPS 199 with the customer.
Select and tailor controls, identifying inherited controls from cloud infrastructure.
Implement and document controls in the system security plan.
Arrange independent assessment and remediate findings.
Support the authorization package and POA&M.
Run continuous monitoring: scanning, configuration management, logging and reporting.

Common controls and inheritance

Not every control has to be implemented by every system. Common controls are provided once and inherited by many systems, for example an agency-wide incident response capability, physical security of a data centre, or identity services. Cloud platforms also provide controls their customers inherit. In the Select step, the system owner identifies which controls are common or inherited, which are hybrid with shared responsibility, and which are system-specific. Clear documentation of inheritance avoids duplicated effort and gaps where each party assumes the other is responsible.

Documentation you will need

System description, boundary diagrams and inventories.
Security categorisation.
System security and privacy plans.
Policies and procedures for each control family.
Assessment plans and reports.
Plan of action and milestones.
Authorization decision documents.
Continuous monitoring strategy and reports.

Timeline and cost considerations

An ATO for a Moderate system typically takes several months to more than a year, depending on maturity, documentation quality and the agency's process. Delays most often come from incomplete documentation, late discovery of control gaps during assessment, and unclear responsibilities between the agency, the vendor and the cloud provider. Costs include engineering for controls, documentation, independent assessment and continuous monitoring. Inheriting controls from authorized cloud infrastructure and automating evidence collection can shorten timelines significantly.

Common mistakes

Treating RMF as paperwork done at the end of development.
Unclear boundaries, leading to scope disputes.
Generic control descriptions that assessors cannot verify.
Ignoring inherited and shared controls from cloud providers.
Weak continuous monitoring, causing findings to accumulate after authorization.

Best practices, tools and technologies

Integrate RMF tasks into the development life cycle from the start.
Use machine-readable control documentation, such as OSCAL, where accepted.
Automate configuration baselines and drift detection.
Automate vulnerability scanning and POA&M tracking.
Build on authorized cloud services to inherit physical and infrastructure controls.

We build systems with NIST 800-53 aligned controls, documented boundaries, logging and continuous monitoring through our web application development and maintenance and support services.

Real-world example

A software company builds a case management system for a federal agency, hosted on a FedRAMP-authorized cloud. With the agency, it categorises the system as Moderate, selects the SP 800-53B Moderate baseline, inherits physical and infrastructure controls from the cloud provider, and documents its own controls in the system security plan. An independent assessor tests the controls, 14 findings go into the POA&M, and the authorizing official grants an ATO with conditions to fix two high findings within 30 days. Monthly scans and configuration checks feed continuous monitoring.

Next steps

Clarify which RMF process applies.
Define boundary and categorisation.
Select and implement controls.
Plan independent assessment.
Set up continuous monitoring.

Frequently asked questions

What is the NIST Risk Management Framework?

The process in NIST SP 800-37 for managing security and privacy risk across a system's life cycle, used by US federal agencies.

What are the seven RMF steps?

Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor.

What is an ATO?

An authorization to operate: a senior official's formal decision that a system's risk is acceptable.

What is the current version of SP 800-37?

Revision 2, published in December 2018, which remains current and is used with SP 800-53 Revision 5 controls.

How is RMF different from the NIST CSF?

The CSF is a high-level outcome framework; the RMF is a detailed system-level process for selecting, assessing and authorising controls.

Is RMF required for contractors?

When they operate systems on behalf of federal agencies, usually yes; FedRAMP applies it to cloud services.

What does categorisation mean in RMF?

Assigning Low, Moderate or High impact for confidentiality, integrity and availability using FIPS 199.

What is continuous monitoring?

Ongoing assessment of controls and the environment to keep authorization decisions informed.

What is ongoing authorization?

An approach where authorization is maintained through continuous monitoring evidence instead of periodic reauthorization.

What is a POA&M?

A plan of action and milestones listing weaknesses, planned fixes and dates.

Who is the authorizing official?

A senior government official with the authority and accountability to accept the risk of operating a system on behalf of the organisation.

Can non-government organisations use the RMF?

Yes. It is publicly available and many private organisations use it, or simplified versions of it, as a rigorous model for managing system risk.

Does the RMF cover privacy?

Yes. Revision 2 integrates privacy risk management, privacy controls and privacy assessments into every step.