thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Risk Management Framework (RMF)

NIST SP 800-37 process for managing security and privacy risk of federal information systems in seven steps.

Definition

The RMF steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. It integrates security and privacy into the system development life cycle and culminates in an authorization decision by an authorizing official. It is required for federal systems under FISMA and is used by DoD via DoDI 8510.01.

Example

A new agency HR system is categorized moderate, assigned the moderate baseline, assessed, and granted an ATO.

Exam tip

Know the step order and that Prepare was added in Rev. 2 (2018).

Related terms