ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX H > THE IMPORTANCE OF ARCHITECTURE AND ENGINEERING

THE IMPORTANCE OF ARCHITECTURE AND ENGINEERING

Security architects, privacy architects, systems security engineers, and privacy engineers can
play an essential role in the SDLC and in the successful execution of the RMF. Security and privacy
architects and engineers provide system owners and authorizing officials with technical advice
on the selection and implementation of controls in information systems-guiding and informing
risk-based decisions across the enterprise.
Security and Privacy Architects:
•
Ensure that security and privacy requirements necessary to protect mission and business
processes are adequately addressed in all aspects of enterprise architecture including
reference models, segment and solution architectures, and the systems supporting those
missions and business processes.
•
Serve as the primary liaison between the enterprise architect and the systems security and
privacy engineers.
•
Coordinate with system owners, common control providers, and system security and
privacy officers on the allocation of controls.
•
Advise authorizing officials, chief information officers, senior accountable officials for risk
management/risk executive (function), senior agency information security officers, and
senior agency officials for privacy on a range of security and privacy issues.
Security and Privacy Engineers:
•
Ensure that security and privacy requirements are integrated into systems and system
elements through purposeful security or privacy architecting, design, development, and
configuration.
•
Employ best practices when implementing controls within a system, including the use of
software engineering methodologies; systems security or privacy engineering principles;
secure or privacy-enhancing design, secure or privacy-enhancing architecture, and secure
or privacy-enhancing coding techniques.
•
Coordinate security and privacy activities with senior agency information security officers,
senior agency officials for privacy, system owners, common control providers, security and
privacy architects, and system security or privacy officers.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > THE PROCESS

THE PROCESS

EXECUTING THE RISK MANAGEMENT FRAMEWORK TASKS
his chapter describes the steps and associated tasks that comprise the RMF and the
selected individuals or groups (defined organizational roles) that carry out such tasks.51
Organizations align their risk management roles with complementary or similar roles
defined for the SDLC whenever possible, and consistent with missions and business functions.
RMF tasks are executed concurrently with, or as part of, the SDLC processes in the organization.
Executing RMF tasks concurrently with SDLC processes helps to ensure that organizations are
effectively integrating the process of managing information security and privacy risks into SDLC
processes. Moreover, the expected outputs required by the RMF (e.g., security and privacy
plans, assessment reports, plans of action and milestones), can be routinely obtained from the
SDLC processes in place within organizations and may not need to be developed solely for RMF
implementation.
The process of implementing RMF tasks may vary from organization to organization. While the
tasks appear in sequential order, there can be many points in the risk management process that
require divergence from the sequential order, including the need for iterative cycles between
initial task execution and revisiting tasks. For example, control assessment results can trigger a
set of remediation actions by system owners and common control providers, which can in turn
require the reassessment of selected controls. Monitoring controls can generate a cycle of
tracking changes to the system and its environment of operation; assessing the information
security and privacy impact; reassessing controls, taking remediation actions, and reporting the
security and privacy posture of the system and the organization.
There may be other opportunities to diverge from the sequential nature of the tasks when it is
more effective, efficient, or cost-effective to do so. For example, while the control assessment
tasks are listed after the control implementation tasks, organizations may begin the assessment
of controls as soon as they are implemented but prior to the complete implementation of all
51 Appendix D describes the roles and responsibilities of key participants involved in organizational risk management
and the execution of the RMF. Many risk management roles defined in this publication have counterpart roles defined
in the SDLC process.
T
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TIPS FOR STREAMLINING RMF IMPLEMENTATION

TIPS FOR STREAMLINING RMF IMPLEMENTATION

•
Use the tasks and outputs of the Organization-Level and System-Level Prepare Step to
promote a consistent starting point within organizations to execute the RMF.
•
Maximize the use of common controls to promote standardized, consistent, and cost-
effective security and privacy capability inheritance.
•
Maximize the use of shared or cloud-based systems, services, and applications where
applicable, to reduce the number of organizational authorizations.
•
Employ organizationally-tailored control baselines to increase the speed of security and
privacy plan development, promote consistency of security and privacy plan content, and
address organization-wide threats.
•
Employ organization-defined controls based on security and privacy requirements
generated from a systems security engineering process.
•
Maximize the use of automated tools to manage security categorization; control selection,
assessment, and monitoring; and the authorization process.
•
Decrease the level of effort and resource expenditures for low-impact systems if those
systems cannot adversely affect higher-impact systems through system connections.
•
Maximize the reuse of RMF artifacts (e.g., security and privacy assessment results) for
standardized hardware/software deployments, including configuration settings.
•
Reduce the complexity of the IT/OT infrastructure by eliminating unnecessary systems,
system elements, and services - employ least functionality principle.
•
Make the transition to ongoing authorization and use continuous monitoring approaches
to reduce the cost and increase the efficiency of security and privacy programs.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > TRADITIONAL AND JOINT AUTHORIZATIONS

TRADITIONAL AND JOINT AUTHORIZATIONS

Organizations can choose from two distinct approaches when planning for and conducting
authorizations. These include an authorization with a single authorizing official or an
authorization with multiple authorizing officials.163 The first approach is the traditional
authorization process defined in this appendix where a single organizational official in a senior
leadership position is responsible and accountable for a system or for common controls. The
organizational official accepts the security and privacy risks that may adversely impact
organizational operations, organizational assets, individuals, other organizations, or the Nation.
The second approach, joint authorization, is employed when multiple organizational officials
either from the same organization or different organizations, have a shared interest in
authorizing a system. The organizational officials collectively are responsible and accountable
for the system and jointly accept the security and privacy risks that may adversely impact
organizational operations and assets, individuals, other organizations, and the Nation. A similar
authorization process is followed as in the single authorizing official approach with the essential
difference being the addition of multiple authorizing officials. Organizations choosing a joint
authorization approach are expected to work together on the planning and the execution of
RMF tasks and to document their agreement and progress in implementing the tasks.
160 Site-specific controls are typically implemented by an organization as common controls. Examples include physical
and environmental protection controls and personnel security controls.
161 Typically, type authorizations are issued by organizations that are responsible for developing standardized
hardware and software capabilities for customers and delivered to the recipient organizations as "turn key" solutions.
The senior leaders issuing such authorizations may be referred to as developmental authorizing officials.
162 For example, if the facility is categorized as moderate impact, it may not be appropriate to locate high-impact
systems or system elements in that environment of operation.
163 Authorization approaches can be applied to systems and to common controls inherited by organizational systems.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > Transitioning from Static Authorization to Ongoing Authorization

Transitioning from Static Authorization to Ongoing Authorization

The intent of continuous monitoring is to monitor controls at a frequency that is sufficient to
provide authorizing officials with the information necessary to make effective, risk-based
decisions, whether by automated or manual means.155 However, if a substantial portion of
monitoring is not accomplished via automation, it will not be feasible or practical to move from
the current static authorization approach to an effective and efficient ongoing authorization
approach. A phased approach for the generation of security and privacy information may be
necessary during the transition as automated tools become available and a greater number of
controls are monitored by automated techniques. Organizations may begin by generating
security and privacy information from automated tools and fill in gaps by generating additional
information from manual assessments. As additional automated monitoring functionality is
added, processes can be adjusted.
Transitioning from a static authorization process to a dynamic, ongoing authorization process
requires considerable thought and planning. One methodology that organizations may consider
is to take a phased approach to the migration based on the security categorization of the
system. Because risk tolerance levels for low-impact systems are likely to be greater than for
moderate-impact or high-impact systems, implementing continuous monitoring and ongoing
authorization for low-impact systems first may ease the transition. The phased approach
starting with low-impact systems allows organizations to incorporate lessons learned as
continuous monitoring and ongoing authorization processes are implemented for moderate-
impact and high-impact systems. Incorporating lessons learned facilitates the consistent
progression of the continuous monitoring and ongoing authorization implementation from the
154 The immediate reviews initiated by specific trigger events may occur simultaneously (i.e., in conjunction) with
time-driven monitoring activities based on the monitoring frequencies established by the organization and how the
reviews are structured within the organization. The same reporting structure may be used for event- and time-driven
reviews to achieve efficiencies.
155 Privacy continuous monitoring means maintaining ongoing awareness of privacy risks and assessing privacy
controls at a frequency sufficient to ensure compliance with applicable privacy requirements and to manage privacy
risks.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > TYPE AND FACILITY AUTHORIZATIONS

TYPE AND FACILITY AUTHORIZATIONS

A type authorization159 is an official authorization decision that allows for a single authorization
package to be developed for an archetype (i.e., common) version of a system. This includes, for
example hardware, software, or firmware components that are deployed to multiple locations
for use in specified environments of operation (e.g., system installation and configuration
requirements or operational security and privacy needs provided by the host organization at a
specific location). A type authorization is appropriate when the system is deployed in a defined
environment and is comprised of identical instances of system architecture, software, identical
information types, functionally identical hardware, information that is processed in the same
way, identical control implementations, or identical configurations. A type authorization is used
159 Examples of type authorizations include: an authorization of the hardware and software applications for a
standard financial system deployed in multiple locations; or an authorization of a common workstation or operating
environment (i.e., hardware, operating system, and applications) deployed to all operating units within an
organization.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > TYPES OF AUTHORIZATIONS

TYPES OF AUTHORIZATIONS

Authorization is the process by which a senior management official, the authorizing official,
reviews security and privacy information describing the current security and privacy posture of
information systems or common controls that are inherited by systems. The authorizing official
uses this information to determine if the mission/business risk of operating a system or
providing common controls is acceptable-and if it is, explicitly accepts the risk. Security and
privacy information is presented to the authorizing official in an authorization package, which
may consist of a report from an automated security/privacy management and reporting tool.125
System and common control authorization occurs as part of the RMF Authorize step. A system
authorization or a common control authorization can be an initial authorization, an ongoing
authorization, or a reauthorization as defined below:
•
Initial authorization is defined as the initial (start-up) risk determination and risk acceptance
decision based on a complete, zero-based review of the system or of common controls. The
zero-based review of the system includes an assessment of all implemented system-level
controls (including the system-level portion of the hybrid controls) and a review of the
security status of inherited common controls as specified in security and privacy plans.126
The zero-based review of common controls (other than common controls that are system-
based) includes an assessment of applicable controls (e.g., policies, operating procedures,
implementation information) that contribute to the provision of a common control or set of
common controls.
•
Ongoing authorization is defined as the subsequent (follow-on) risk determinations and risk
acceptance decisions taken at agreed-upon and documented frequencies in accordance with
the organization's mission/business requirements and organizational risk tolerance. Ongoing
authorization is a time-driven or event-driven authorization process. The authorizing official
is provided with the necessary information regarding the near real-time security and privacy
posture of the system to determine whether the mission/business risk of continued system
125 [SP 800-137] provides information on automated security management and reporting tools. Future publications
will address privacy management and reporting tools.
126 The zero-based review of a system does not require a zero-based review of the common controls that are available
for inheritance by that system. The common controls are authorized under a separate authorization process with a
separate authorizing official accepting the risk associated with the provision of those controls. The review of the
security and privacy plans containing common controls is necessary to understand the current state of the controls
being inherited by organizational systems and factoring this information into risk-based decisions associated with the
system.
T
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK A-4

TASK A-4 Prepare the assessment reports documenting the findings and recommendations from the control assessments. Potential Inputs: Completed control assessments and associated assessment evidence. Expected Outputs: Completed security and privacy assessment reports detailing the assessor findings and recommendations. Primary Responsibility: Control Assessor. Supporting Roles: System Owner; Common Control Provider; System Security Officer; System Privacy Officer. System Development Life Cycle Phase: New - Development/Acquisition; Implementation/Assessment. Existing - Operations/Maintenance. Discussion: The results of the security and privacy control assessments, including recommendations for correcting deficiencies in the implemented controls, are documented in the assessment reports92 by control assessors. Organizations may develop a single, integrated security and privacy assessment report. Assessment reports are key documents in the system or common control authorization package that is developed for authorizing officials. The assessment reports include information based on assessor 91 In accordance with [OMB A-130], an independent evaluation of privacy program and practices is not required. However, an organization may choose to employ independent privacy assessments at the organization's discretion. 92 If a comparable report meets the requirements of what is to be included in an assessment report, then the comparable report would itself constitute the assessment report.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK A-5

TASK A-5 Conduct initial remediation actions on the controls and reassess remediated controls. Potential Inputs: Completed security and privacy assessment reports with findings and recommendations; security and privacy plans; security and privacy assessment plans; organization- and system-level risk assessment results. Expected Outputs: Completed initial remediation actions based on the security and privacy assessment reports; changes to implementations reassessed by the assessment team; updated security and privacy assessment reports; updated security and privacy plans including changes to the control implementations. Primary Responsibility: System Owner; Common Control Provider; Control Assessor. Supporting Roles: Authorizing Official or Authorizing Official Designated Representative; Senior Agency Information Security Officer; Senior Agency Official for Privacy; Senior Accountable Official for Risk Management or Risk Executive (Function); Information Owner or Steward; Systems Security Engineer; Privacy Engineer; System Security Officer; System Privacy Officer. System Development Life Cycle Phase: New - Development/Acquisition; Implementation/Assessment. Existing - Operations/Maintenance. Discussion: The security and privacy assessment reports describe deficiencies in the controls that could not be resolved during the development of the system or that are discovered post-development. Such control deficiencies may result in security and privacy risks (including supply chain risks). The findings generated during control assessments, provide information that facilitates risk responses based on organizational risk tolerance and priorities. The authorizing official, in consultation and coordination with system owners and other organizational officials, may decide that certain findings represent significant, unacceptable risk and require immediate remediation actions. Additionally, it may be possible and practical to conduct initial remediation actions for assessment findings that can be quickly and easily remediated with existing resources. If initial remediation actions are taken, assessors reassess the controls. The control reassessments determine the extent to which remediated controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements for the
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK A-6

TASK A-6 Prepare the plan of action and milestones based on the findings and recommendations of the assessment reports. Potential Inputs: Updated security and privacy assessment reports; updated security and privacy plans; organization- and system-level risk assessment results; organizational risk management strategy and risk tolerance. 93 Risk assessments are conducted as needed at the organizational level, mission/business level, and at the system level throughout the SDLC. Risk assessment is specified as part of the RMF Prepare-Organization Level step, Task P-3 and RMF Prepare-System Level step, Task P-14.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > CATEGORIZE TASKS > TASK C-1

TASK C-1 Document the characteristics of the system. Potential Inputs: System design and requirements documentation; authorization boundary information; list of security and privacy requirements allocated to the system, system elements, and the environment 74 The RMF Categorize step is a precondition for the selection of security controls. However, for privacy, there are other factors considered by organizations that guide and inform the selection of privacy controls. These factors are described in the RMF Prepare-System Level step, Task P-15.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > CATEGORIZE TASKS > TASK C-2

TASK C-2 SECURITY CATEGORIZATION • A security categorization of the system, including the information processed by the system represented by the organization- identified information types, is completed. [Cybersecurity Framework: ID.AM-1; ID.AM-2; ID.AM-3; ID.AM-4; ID.AM-5] • Security categorization results are documented in the security, privacy, and SCRM plans. [Cybersecurity Framework: Profile] • Security categorization results are consistent with the enterprise architecture and commitment to protecting organizational missions, business functions, and mission/business processes. [Cybersecurity Framework: Profile] • Security categorization results reflect the organization's risk management strategy.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK C-3

TASK C-3 Review and approve the security categorization results and decision. Potential Inputs: Impact levels determined for each information type and for each security objective (confidentiality, integrity, availability); security categorization based on high-water mark of information type impact levels; list of high value assets for the organization. Expected Outputs: Approval of security categorization for the system. Primary Responsibility: Authorizing Official or Authorizing Official Designated Representative; Senior Agency Official for Privacy.75 75 The senior agency official for privacy participates in determining whether the information processed by the information system is considered PII, and is involved in reviewing and approving the categorization for such systems.