thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

NIST SP 800-37

NIST publication defining the Risk Management Framework for information systems and organizations.

Definition

SP 800-37 Rev. 2 (December 2018) defines the seven-step RMF, roles such as authorizing official and system owner, and authorization types including ongoing and type authorizations. It integrates privacy risk management and supply chain risk. It links to SP 800-53 for controls and SP 800-53A for assessment.

Example

An agency follows SP 800-37 tasks P-1 through M-7 for each system.

Exam tip

When asked which NIST document defines the RMF, answer SP 800-37.

Related terms