NIST SP 800-37: the Risk Management Framework (US · NIST SP 800-37)

What category of process this is

NIST Special Publication 800-37 Revision 2 is the subject. The official title is Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. It describes the Risk Management Framework (RMF) and guidelines to apply that framework to information systems and organizations.

The CSRC abstract describes the RMF as a disciplined, structured, and flexible process to manage security and privacy risk. The process covers categorization and control selection, implementation, and assessment. The process includes system and common control authorizations, and continuous monitoring. It also includes organization-level prepare activities. Execution of the tasks links system-level risk work to organization-level risk management.

Edition covered

SP 800-37 Rev. 2, Date Published December 2018, Final 20 December 2018 (2018-12-20). DOI 10.6028/NIST.SP.800-37r2. The PDF is NIST.SP.800-37r2 on nvlpubs. This Final supersedes SP 800-37 Rev. 1 (5 June 2014) and CSWP 3 (3 June 2014).

Document history on the CSRC page ends at Final 2018-12-20. That full citation is the correct reference for the publication. If a newer Final appears, this pin must change. The older claim is then UNKNOWN.

Why SP 800-37 sits after FISMA

FISMA (FISMA: federal information security) is the statutory and program backdrop for federal agency information security management. NIST states that the suite of risk management standards and guidelines is not a FISMA compliance checklist.

RMF is the risk process that an agency runs. FISMA is the why and who backdrop. SP 800-37 is how the process is framed. RMF and FISMA are not one object.

Seven steps

The NIST RMF project page lists seven steps in this order. The steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. Rev. 2 emphasizes Prepare (organization-wide readiness before system-level work), privacy alongside security, continuous monitoring and ongoing authorization, and the system life cycle.

Information Security Continuous Monitoring (ISCM) strategy and program themes are in SP 800-137 (NIST SP 800-137: continuous monitoring). Monitors that run do not mean that the seven steps are finished. Monitor activity is not an Authorization that lasts forever.

Authorize is a risk-based decision

Authorize means a senior official makes a risk-based decision to authorize the system (to operate). That decision is not a product SKU. One pass through the seven steps is not forever Authorized.

A FedRAMP Marketplace Authorization for a cloud offering is a different lane (FedRAMP: federal cloud authorization). The customer still configures. An agency authorization of its own system under RMF is not the same object.

Select is not the entire catalog

Select means choose the set of NIST SP 800-53 controls to protect the system based on risk assessment(s). It is a risk-based selection from the catalog, and the selected set can be tailored. It does not mean implement every control in the catalog. Baselines are in companion publications, not in SP 800-37.

SP 800-53 (NIST SP 800-53: choosing security and privacy controls) is the catalog. SP 800-37 does not list the control families.

The assessments that inform Select have their own publication. NIST SP 800-30 Rev. 1 (NIST SP 800-30: assessing risk) is the guide for conducting risk assessments. An assessment document is not the seven RMF steps finished.

What SP 800-37 is not

SP 800-37 is not a FISMA badge. It is not FedRAMP homework. It is not CMMC. It is not SP 800-171. It is not a seven-box weekend list.

A state or local agency does not automatically run federal RMF the same way an executive agency runs a FISMA program. That coverage question escalates to counsel, the authorizing official, or the contracting officer. Those owners decide who must run the process.

Rewrite the one-line claim

The one-blob claim "we are RMF, FISMA, and FedRAMP compliant" mixes three objects. Two lanes replace it. The first lane sentence is "We use the SP 800-37 Rev. 2 RMF process for an agency system." That lane is different from a FedRAMP cloud offering lane.

At work, the team privately asks who the authorizing official (or equivalent owner) is for one system that the team touches. The team also asks which lane applies.

RMF is not a FISMA checklist and not FedRAMP homework

Four phrases about RMF, each with its correction.
Phrase people use	Literacy correction
We finished RMF, so FISMA is a checklist done	NIST states that the suite is not a FISMA compliance checklist. RMF is a risk process. FISMA is the program and statutory backdrop. Explainer: /learn/explainers/fisma/.
RMF equals a FedRAMP Authorization package	FedRAMP standardizes reusable cloud product and service assessments and Authorizations for agency adoption. RMF is the broader process that agencies use for systems. Explainer: /learn/explainers/fedramp/.
The finished Assess step is an Authorization to Operate	An Authorization to Operate is a risk-based decision of a senior official.
Select means implement every 800-53 control	Select is a risk-based selection from the catalog, and the selected set can be tailored. Baselines are in companions. Reference card: /reference/frameworks/nist-sp-800-53-r5/.

Common misconceptions

RMF is a FISMA compliance checklist.

NIST states that the risk-management suite is not a FISMA compliance checklist. RMF runs the risk work. FISMA sets the program and statutory backdrop.

One pass through the seven steps means the system is forever Authorized.

Monitor is continuous. An authorization decision is not a one-time badge that never needs another look.

RMF and FedRAMP are the same Authorization homework.

FedRAMP is reusable cloud product and service Authorization. RMF is a broader process for agency systems. The vocabulary is related, but the object is different.

Assess is the step that authorizes the system.

Assess finds whether the controls are implemented correctly, operate as intended, and produce the desired outcome. Authorize is a separate step. In that step, a senior official decides whether the risk is acceptable.

Select means implement the entire SP 800-53 catalog.

Select is risk-based selection from the catalog. SP 800-53 holds the catalog. The selected set is not every family.

A state or local agency must run federal RMF the same way an executive agency runs FISMA.

Counsel, the authorizing official, or the contracting officer decides that coverage question.

Official RMF steps

The steps come from the NIST RMF project page.

Seven RMF steps in official order, each with its boundary.
Step	Official theme	Boundary
Prepare	Essential activities to prepare the organization to manage security and privacy risks	Organization-wide readiness before system-level work.
Categorize	Categorize the system and information processed, stored, and transmitted based on an impact analysis	Impact analysis theme. Not a determination for a real system.
Select	Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)	Risk-based selection from the catalog. Not every control. Reference card: /reference/frameworks/nist-sp-800-53-r5/.
Implement	Implement the controls and document how controls are deployed	Deployment documentation theme. Not an implementation dump.
Assess	Assess to determine if the controls are in place, operating as intended, and producing the desired results	Assessment theme. Not an assessment-procedure catalog.
Authorize	Senior official makes a risk-based decision to authorize the system (to operate)	A senior-official decision.
Monitor	Continuously monitor control implementation and risks to the system	Continuous. One pass through the list is not forever Authorized.

CHECK THE CATEGORY

Which statement describes NIST SP 800-37 Rev. 2 and the Risk Management Framework (RMF) accurately?

Glossary and nearby pages

Use the agency page in the sources for the authoritative text.