SP 800-37r2SP 800Finalpublication
SP 800-37 Rev. 2 - Risk Management Framework for Information Systems and Organizations
Describes the Risk Management Framework (RMF) and provides guidelines for applying it to information systems and organizations. Outlines seven steps including categorize, select, implement, assess, authorize, monitor, and prepare.
Publication Number
800-37
Series
SP 800
Revision
2
Status
Final
Date
2018-12
risk management frameworkauthorizationsystem lifecyclecontinuous monitoring
References(14)
SP 800-53r5SP 800-53 Rev. 5 - Security and Privacy Controls for Information Systems and OrganizationsFIPS 199FIPS 199 - Standards for Security Categorization of Federal Information and Information SystemsFIPS 200FIPS 200 - Minimum Security Requirements for Federal Information and Information SystemsSP 800-53Ar5SP 800-53A Rev. 5 - Assessing Security and Privacy Controls in Information Systems and OrganizationsSP 800-137r1SP 800-137 Rev. 1 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and OrganizationsSP 800-30r1SP 800-30 Rev. 1 - Guide for Conducting Risk AssessmentsSP 800-39SP 800-39 - Managing Information Security RiskSP 800-60v1r1SP 800-60 Vol. 1 Rev. 1 - Guide for Mapping Types of Information and Information Systems to Security CategoriesSP 800-128SP 800-128 - Guide for Security-Focused Configuration Management of Information SystemsCSF 2.0NIST Cybersecurity Framework (CSF) 2.0SP 800-160v1r1SP 800-160 Vol. 1 Rev. 1 - Engineering Trustworthy Secure SystemsSP 800-161r1SP 800-161 Rev. 1 - Cybersecurity Supply Chain Risk Management PracticesNISTIR 8286NISTIR 8286 - Integrating Cybersecurity and Enterprise Risk Management (ERM)NISTIR 8170NISTIR 8170 - Approaches for Federal Agencies to Use the Cybersecurity Framework