FWK

NIST Risk Management Framework RMF

NIST SP 800-37

A seven-step process, defined in NIST SP 800-37, for selecting, implementing, and monitoring security and privacy controls on a federal information system: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.

For small firms

Even outside federal contracting, the sequence is a clean mental model for rolling out controls on any new system.

Related terms

FWK Prepare Step 1 of the RMF — set priorities and groundwork before anything else. FWK Authorize Step 6 of the RMF — a senior official formally approves the system to run. GRC NIST Cybersecurity Framework 2.0 A framework built around six functions for structuring a cybersecurity program.
← Back to Frameworks & steps