Risk Management Framework for Information Systems and Organizations, September 2017 NIST SP 800-37

by National Institute of Standards and Technology

NIST SP 800-37 Revision 2 - Discussion Draft - Released 28 Sept 2017

This publication provides guidelines for applying the Risk Management Framework (RMF) to information systems and organizations. The RMF includes a disciplined, structured, and flexible process for organizational asset valuation; security and privacy control selection, implementation, and assessment; system and control authorizations; and continuous monitoring. It also includes enterprise-level activities to help better prepare organizations to execute the RMF at the system level. The RMF promotes the concept of near real-time risk management and ongoing system authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make cost-effective, risk management decisions about the systems supporting their missions and business functions; and integrates security and privacy controls into the system development life cycle.

Kindle Edition

Published October 27, 2017