Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
Executive Summary (part 2)

•
To promote the development of trustworthy secure software and systems by aligning life
cycle-based systems engineering processes in NIST Special Publication 800-160, Volume 1
[SP 800-160 v1], with the relevant tasks in the RMF; •
To integrate security-related, supply chain risk management (SCRM) concepts into the RMF
to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized
production, theft, insertion of malicious code, and poor manufacturing and development
practices throughout the SDLC; and
•
To allow for an organization-generated control selection approach to complement the
traditional baseline control selection approach and support the use of the consolidated
control catalog in NIST Special Publication 800-53, Revision 5. The addition of the Prepare step is one of the key changes to the RMF-incorporated to achieve
more effective, efficient, and cost-effective security and privacy risk management processes. The primary objectives for institutionalizing organization-level and system-level preparation are: •
To facilitate effective communication between senior leaders and executives at the
organization and mission/business process levels and system owners at the operational
level; •
To facilitate organization-wide identification of common controls and the development of
organizationally-tailored control baselines, reducing the workload on individual system
owners and the cost of system development and asset protection; •
To reduce the complexity of the information technology (IT) and operations technology (OT)
infrastructure using Enterprise Architecture concepts and models to consolidate, optimize,
and standardize organizational systems, applications, and services; •
To reduce the complexity of systems by eliminating unnecessary functions and security and
privacy capabilities that do not address security and privacy risk; and
•
To identify, prioritize, and focus resources on the organization's high value assets (HVA) that
require increased levels of protection-taking measures commensurate with the risk to such
assets. By achieving the above objectives, organizations can simplify RMF execution, employ innovative
approaches for managing risk, and increase the level of automation when carrying out specific
tasks. Organizations implementing the RMF will be able to: -
Use the tasks and outputs of the Organization-Level and System-Level Prepare step to
promote a consistent starting point within organizations to execute the RMF; -
Maximize the use of common controls at the organization level to promote standardized,
consistent, and cost-effective security and privacy capability inheritance; -
Maximize the use of shared or cloud-based systems, services, and applications to reduce the
number of authorizations needed across the organization; -
Employ organizationally-tailored control baselines to increase the speed of security and
privacy plan development and the consistency of security and privacy plan content; -
Employ organization-defined controls based on security and privacy requirements
generated from a systems security engineering process; -
Maximize the use of automated tools to manage security categorization; control selection,
assessment, and monitoring; and the authorization process; -
Decrease the level of effort and resource expenditures for low-impact systems if those
systems cannot adversely affect higher-impact systems through system connections; -
Maximize the reuse of RMF artifacts (e.g., security and privacy assessment results) for
standardized hardware/software deployments, including configuration settings; -
Reduce the complexity of the IT/OT infrastructure by eliminating unnecessary systems,
system components, and services - employing the least functionality principle; and
-
Make the transition to ongoing authorization a priority and use continuous monitoring
approaches to reduce the cost and increase the efficiency of security and privacy programs. Recognizing that the preparation for RMF execution may vary from organization to organization,
achieving the above objectives can reduce the overall IT/OT footprint and attack surface of
organizations, promote IT modernization objectives, conserve resources, prioritize security
activities to focus protection strategies on the most critical assets and systems, and promote
privacy protections for individuals.