The NIST Risk Management Framework (NIST RMF) is a process from the US National Institute of Standards and Technology for managing security and privacy risk across an information system’s life. Defined in NIST Special Publication 800-37, it ties together categorizing a system, choosing and implementing controls, assessing them, having a senior official formally accept the risk, and monitoring the system afterward. Federal agencies use it for their systems, and companies meet it when they build or run systems for government customers. This entry is general information, not legal advice.
At a glance
- The RMF has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor.
- It is defined in NIST SP 800-37; Revision 2 (December 2018) is the current revision.
- It links other NIST documents: FIPS 199 for categorization, SP 800-53 for controls and SP 800-53A for assessment.
- The Authorize step produces a formal decision, often called an authorization to operate (ATO).
- It is distinct from the NIST AI Risk Management Framework.
What problem it solves
Security standards tell you what controls exist, but not how to decide which ones a system needs, who signs off on the remaining risk, or how to keep that decision current. Without a process, controls get chosen inconsistently, assessments become one-off exercises, and nobody is clearly accountable for accepting risk.
The RMF supplies that process. It makes the level of protection depend on the system’s impact, requires evidence that controls work, puts a named official on the hook for the risk decision, and treats monitoring as ongoing. For buyers working with federal customers, it explains why paperwork such as security plans and assessment reports matters as much as the technology.
How it works
The steps build on each other, and the cycle repeats as systems and threats change.
Prepare. Set up the organization and system context: roles, risk strategy, common controls and priorities.
Categorize. Determine the system’s impact level based on the information it handles, typically using FIPS 199.
Select. Choose a starting baseline from NIST SP 800-53 and its companion SP 800-53B, then tailor it to the system.
Implement. Put the controls in place and document how each one is met.
Assess. Test whether controls are implemented correctly and working as intended, using procedures such as those in SP 800-53A.
Authorize. A senior official, the authorizing official, reviews the results and remaining risk and decides whether to approve operation.
Monitor. Track changes, reassess controls and report on security and privacy posture on an ongoing basis.
Risk assessment runs through several steps; NIST’s SP 800-30 gives guidance on conducting risk assessments.
RMF steps
The RMF has no maturity levels. Its structure is the seven steps, each producing evidence that the next step relies on.
| Step | What happens | Who typically does it | Typical evidence |
|---|---|---|---|
| Prepare | Establish roles, risk strategy and common controls | Organization leadership and system owner | Risk strategy, role assignments |
| Categorize | Set the system’s impact level | System owner with security staff | Security categorization |
| Select | Choose and tailor a control baseline | System owner and security staff | Control selection in the system security plan |
| Implement | Put controls in place and document them | System and operations teams, providers | Updated system security plan |
| Assess | Test whether controls work | Assessor, often independent of the system team | Security assessment report, plan of action |
| Authorize | Accept or reject the remaining risk | Authorizing official | Authorization decision (often an ATO) |
| Monitor | Track changes and reassess over time | System owner, security staff, providers | Continuous monitoring reports |
Who performs each step and how independent the assessor must be depend on the agency and program, so confirm the rules that apply to your contract.
When it matters for buyers
- When you build or run a system for a federal agency. Agencies apply the RMF under FISMA, and your system may need an authorization.
- When choosing cloud services for government work. FedRAMP follows a similar categorize-assess-authorize-monitor pattern, and a provider’s package can feed an agency’s authorization.
- When a provider will handle part of your controls. Their documentation becomes evidence in your assessment.
- When you want a repeatable process for high-risk systems. Some organizations adopt the RMF voluntarily.
Our governance, risk and compliance overview covers advisors and platforms that manage security plans, assessments and continuous monitoring.
Questions to ask vendors
- Has your service been through an authorization process, and which agency or program granted it?
- Can you provide your system security plan, assessment report and customer responsibility matrix?
- Which impact level and control baseline was your service assessed against?
- How do you report changes, vulnerabilities and incidents for continuous monitoring?
- Who would we contact if our authorizing official needs more evidence?
How it differs from the NIST Cybersecurity Framework
The NIST Cybersecurity Framework (NIST CSF) describes security outcomes for a whole organization and leaves the method up to you; it has no authorization step and no certification. The RMF is a defined, system-by-system process with formal categorization, control selection, assessment and sign-off. Many organizations use the CSF for program-level planning and reporting, and the RMF where systems must be formally authorized. Neither should be confused with the NIST AI Risk Management Framework, which addresses risks from AI systems.
Problems this helps with
- A federal customer says our system needs an authorization to operate
- Not sure how categorization, controls, assessment and authorization fit together
- Security work on a system is ad hoc instead of following a repeatable process
