Risk Management Framework (RMF)
Purpose and structure
The Risk Management Framework (RMF) is NIST's disciplined, risk-based process for integrating security, privacy, and supply-chain risk management into the system development life cycle. Under SP 800-37 Revision 2 it has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The Prepare step, added in Revision 2, is organization-wide: it establishes risk tolerance, roles and responsibilities, an inventory of systems and common controls, prioritization, and the monitoring strategy. Candidates must know the purpose and key outputs of each step and the roles: Authorizing Official (AO), system owner, ISSO, security control assessor (SCA), and common control provider.
Traps and sequencing
Questions often test sequencing and feedback loops. Categorization must precede control selection; selection precedes implementation; assessment precedes authorization; monitoring feeds back into all steps. The RMF is not a one-time certification event, and an authorization is not a claim that a system is perfectly secure. Another trap is confusing the RMF with the control catalog: the RMF is the process; SP 800-53 is a tool used within it. Also remember the RMF applies at organization, mission/business, and system levels, not only to systems.
Worked example
A team selects controls before finalizing the security category. That is a sequencing error: the baseline depends on the category, so selection would have to be redone. Rule of thumb: categorize, then select; implement, then assess; authorize, then monitor.