NIST in its partnership with the Department of Defense, the Office of the Director of National Intelligence, and the Committee on National Security Systems, developed a Risk Management Framework (RMF) to improve information security, strengthen risk management processes, and encourage reciprocity among organizations.

The RMF emphasizes risk management by promoting the development of security and privacy capabilities into information systems throughout the system development life cycle (SDLC); by maintaining situational awareness of the security and privacy posture of those systems on an ongoing basis through continuous monitoring processes by providing information to senior leaders and executives to facilitate decisions regarding the acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation arising from the use and operation of their systems.

This Framework provide:

Provides a repeatable process designed to promote the protection of information and information systems commensurate with risk;

• Emphasizes organization-wide preparation necessary to manage security and privacy risks.

• Facilitates the categorization of information and systems, the selection, implementation, assessment, and monitoring of controls, and the authorization of information systems and common controls.

• Promotes the use of automation for near real-time risk management and ongoing system and control authorization through the implementation of continuous monitoring processes.

• Encourages the use of correct and timely metrics to provide senior leaders and managers with the necessary information to make cost-effective, risk-based decisions for information systems supporting their missions and business functions.

• Facilitates the integration of security and privacy requirements and controls into enterprise architecture, SDLC, acquisition processes, and systems engineering processes.

• Connects risk management processes at the organization and mission/business process levels to risk management processes at the information system level through a senior accountable official for risk management and risk executive.

• Establishes responsibility and accountability for controls implemented within information systems and inherited by those systems.