Risk Management

The select step provides the standards and guidance for selecting appropriate security controls to help reduce system vulnerability and minimize risk. The FIPS 200 – Minimum Security Requirements for Federal Information and Information Systems, and SP 800-53 Rev 3 – Recommended Security Controls for Federal Information Systems and Organizations are used as a starting point for determining the required controls that will be implemented to reduce threats and manage risks from operating information systems. The key activities involved in the security control selection process are risk assessment, identify standard controls, select the baseline controls, and document the selected controls in the security plan.

The implementing step is where the security controls are implemented. It is a critical part of the RMF since it a!ects the security state and risk posture of the entire organization. The three NIST SP documents that support this step are NIST SP 800-53 – Recommended Security Controls for Federal Information Systems and Organizations, NIST SP 800-53A – Guide for Assessing the Security Controls in Federal Information systems, and NIST SP 800-70 – Security Configuration checklists Program for IT Products – Guidance for Checklist Users and Developers. The implementation of security controls is based on the assessment of risk, organization-specific security requirements, threat information, and cost-benefit analyses.

The assess step determines the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome to meeting the security requirements for the system. The supporting NIST publication for this step is NIST SP 800-53A Rev 4 – Recommended Security Controls for Federal Information Systems and Organizations. During the assessment step, the Security Assessment Report is produced and used in making an authorized decision.

The authorize step is where the management decision is made to allow operation of an information system and to explicitly accept the risk to organizational operations, assets, and individuals. The NIST publication that supports this step is NIST SP 800-37 Rev 2 – Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Lifecycle Approach. A prioritized approach to risk mitigation should be adopted throughout the organization since most information systems have more vulnerabilities than available resources can address.

Continuous monitoring is the final step in the RMF. Its primary goal is to determine the security controls in the information system continue to be e!ective over time in light of the unavoidable changes to hardware, software, and firmware that occur in the systems, as well as changes in the environment in which the system operates. The supporting NIST publication for this is NIST SP 800-37 Rev 2 – Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Lifecycle Approach and NIST SP 800-53A – Guide for Assessing the Security Controls in Federal Information systems. Continuous monitoring provides on-going, up-to-date information about an organization’s security state and enables them to make credible, risk-based decisions NIST (n.d). The knowledge I gained from this course will help in developing information security standards and guidelines within my organization. It also allows me to be ethical when implementing the framework since it requires a high degree of precision in determining risk, mitigating threats, and maintaining accountability.