NIST Risk Management Framework | CSRC

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Projects NIST Risk Management Framework

NIST Risk Management Framework RMF

About the Risk Management Framework (RMF)

A Comprehensive, Flexible, Risk-Based Approach

The Risk Management Framework (RMF) provides a process that integrates security, privacy, and cyber supply chain risk management activities into the system development life cycle. The risk-based approach to control selection and specification considers effectiveness, efficiency, and constraints due to applicable laws, directives, Executive Orders, policies, standards, or regulations. Managing organizational risk is paramount to effective information security and privacy programs; the RMF approach can be applied to new and legacy systems, any type of system or technology (e.g., IoT, control systems), and within any type of organization regardless of size or sector. The RMF is one of many publications developed by the Joint Task Force (JTF). 

 

NIST SP 800-37 The Risk Management Framework Steps

 

 

For more information on each RMF Step, including Resources for Implementers and Supporting NIST Publications, select the Step below.

Prepare Essential activities to prepare the organization to manage security and privacy risks 
Categorize Categorize the system and information processed, stored, and transmitted based on an impact analysis
Select Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)
Implement Implement the controls and document how controls are deployed
Assess Assess to determine if the controls are in place, operating as intended, and producing the desired results
Authorize Senior official makes a risk-based decision to authorize the system (to operate)
Monitor Continuously monitor control implementation and risks to the system

 

RMF Publication Download  

RMF Resources 

These resources may be used by governmental and nongovernmental organizations, and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. 

Graphics 

Quick Start Guides (QSG) for the RMF Steps

  • Download RMF QSG: Prepare Step FAQ [.pdf] 
  • Download RMF QSG: Categorize Step FAQ [.pdf] 
  • Download RMF QSG: Select Step FAQ [.pdf] 
  • Download RMF QSG: Implement Step FAQ [.pdf] 
  • Download RMF QSG: Assess Step FAQ [.pdf] 
  • Download RMF QSG: Authorize Step FAQ [.pdf]
  • Download RMF QSG: Monitor Step FAQ [.pdf] 
  • Download RMF QSG: ALL FAQs [.zip]
  • Download RMF QSG: Roles and Responsibilities [.pdf] [.xlsx]
  • Download RMF QSG: Resources [.pdf] 
  • Download RMF QSG: Small Enterprise [.pdf]

Back to RMF Homepage

Contacts

NIST Risk Management Framework Team
sec-cert@nist.gov

Created November 30, 2016, Updated September 24, 2024