ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > TASK P-3

TASK P-3 Assess organization-wide security and privacy risk and update the risk assessment results on an ongoing basis. Potential Inputs: Risk management strategy; mission or business objectives; current threat information; system-level security and privacy risk assessment results; supply chain risk assessment results; previous organization-level security and privacy risk assessment results; information sharing agreements or memoranda of understanding; security and privacy information from continuous monitoring. Expected Outputs: Organization-level risk assessment results. Primary Responsibility: Senior Accountable Official for Risk Management or Risk Executive (Function); Senior Agency Information Security Officer; Senior Agency Official for Privacy. Supporting Roles: Chief Information Officer; Mission or Business Owner; Authorizing Official or Authorizing Official Designated Representative. Discussion: Risk assessment at the organizational level leverages aggregated information from system-level risk assessment results, continuous monitoring, and any strategic risk considerations relevant to the organization. The organization considers the totality of risk from the operation and use of its information systems, from information exchange and connections with other internally and externally owned systems, and from the use of external providers. For example, the organization may review the risk related to its enterprise architecture and information systems of varying impact levels residing on the same network and whether higher impact systems are segregated from lower impact systems or systems operated and maintained by external providers. The organization may also consider the variability of environments that may exist within the organization (e.g., different locations serving different missions/business processes) and the need to account for such variability in risk assessments. Risk assessments of the organization's supply chain may be conducted as well. Risk assessment results may be used to help organizations establish a Cybersecurity Framework Profile. References: [SP 800-30]; [SP 800-39] (Organization Level, Mission/Business Process Level); [SP 800-161]; [IR 8062]. Task Abbreviation Prepare Step
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-5

TASK P-5 Identify, document, and publish organization-wide common controls that are available for inheritance by organizational systems. Potential Inputs: Documented security and privacy requirements; existing common control providers and associated security and privacy plans; information security and privacy program plans; organization- and system-level security and privacy risk assessment results. Expected Outputs: List of common control providers and common controls available for inheritance; security and privacy plans (or equivalent documents) providing a description of the common control implementation (including inputs, expected behavior, and expected outputs). Primary Responsibility: Senior Agency Information Security Officer; Senior Agency Official for Privacy. Supporting Roles: Mission or Business Owner; Senior Accountable Official for Risk Management or Risk Executive (Function); Chief Information Officer; Authorizing Official or Authorizing Official Designated Representative; Common Control Provider; System Owner. Discussion: Common controls are controls that can be inherited by one or more information systems.60 Common controls can include controls from any [SP 800-53] control family, for example, physical and environmental protection controls, system boundary and monitoring controls, personnel security controls, policies and procedures, acquisition controls, account and identity management controls, audit log and accountability controls, or complaint management controls for receiving privacy inquiries from the public. Organizations identify and select the set of common controls and allocate those controls to the organizational entities designated as common control providers. Common controls may differ based upon a variety of factors, such as hosting location, system architecture, and the structure of the organization. The organization-wide list of common controls takes these factors into account. Common controls can also be identified at different levels of the organization (e.g., corporate, department, or agency level; bureau or subcomponent level; or individual program level). Organizations may establish one or more lists of common controls that can be inherited by information systems. A requirement may not be fully met by a common control. In such cases, the control is considered a hybrid control and is noted as such by the organization, including specifying which parts of the control requirement are provided for inheritance by the common control and which parts are to be provided at the system level. 58 See [OMB M-19-03]. 59 See [NIST CSF], Section 2.3. 60 Common controls are authorized by designated authorizing officials before the controls are made available for inheritance by organizational systems. See Appendix F for a description of the different types of authorizations.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-6

TASK P-6 Prioritize organizational systems with the same impact level. Potential Inputs: Security categorization information for organizational systems; system descriptions; organization- and system-level risk assessment results; mission or business objectives; Cybersecurity Framework Profiles. Expected Outputs: Organizational systems prioritized into low-, moderate-, and high-impact sub- categories. Primary Responsibility: Senior Accountable Official for Risk Management or Risk Executive (Function). 61 Organizations can use this task in conjunction with the optional RMF Prepare-Organization Level step, Task P4, to develop organizationally-tailored baselines for the more granular impact designations, for example, organizationally- tailored baselines for low-moderate systems and high-moderate systems.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > PREPARE TASKS—ORGANIZATION LEVEL 53 > TASK P-7

TASK P-7 CONTINUOUS MONITORING STRATEGY- ORGANIZATION • An organization-wide strategy for monitoring control effectiveness is developed and implemented. [Cybersecurity Framework: DE.CM; ID.SC-4] Quick link to summary table for RMF tasks, responsibilities, and supporting roles. 52 The Prepare step is intended to leverage activities already being conducted within security, privacy, and supply chain programs to emphasize the importance of having organization-wide governance and the appropriate resources in place to enable the execution of cost-effective and consistent risk management processes across the organization. 53 For ease of use, the preparatory activities are grouped into organization-level preparation and information system- level preparation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > PREPARE TASKS—SYSTEM LEVEL > TASK P-8

TASK P-8 Identify the missions, business functions, and mission/business processes that the system is intended to support. Potential Inputs: Organizational mission statement; organizational policies; mission/business process information; system stakeholder information; Cybersecurity Framework Profiles; requests for proposal or other acquisition documents; concept of operations. Expected Outputs: Missions, business functions, and mission/business processes that the system will support. Primary Responsibility: Mission or Business Owner.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK P-9

TASK P-9 Identify stakeholders who have an interest in the design, development, implementation, assessment, operation, maintenance, or disposal of the system. Potential Inputs: Organizational mission statement; mission or business objectives; missions, business functions, and mission/business processes that the system will support; other mission/business process information; organizational security and privacy policies and procedures; organizational charts; information about individuals or groups (internal and external) that have an interest in and decision- making responsibility for the system. Expected Outputs: List of system stakeholders. Primary Responsibility: Mission or Business Owner; System Owner. Supporting Roles: Chief Information Officer; Authorizing Official or Authorizing Official Designated Representative; Information Owner or Steward; Senior Agency Information Security Officer; Senior Agency Official for Privacy; Chief Acquisition Officer. System Development Life Cycle Phase: New - Initiation (concept/requirements definition). Existing - Operations/Maintenance. Discussion: Stakeholders include individuals, organizations, or representatives that have an interest in the system throughout the system life cycle-for design, development, implementation, delivery, operation, and sustainment of the system. It also includes all aspects of the supply chain. Stakeholders may reside in the same organization or they may reside in different organizations in situations when there is a common interest by those organizations in the information system. For example, this may occur during the development, operation, and maintenance of cloud-based systems, shared service systems, or any system where organizations may be adversely impacted by a breach or a compromise to the system or for a variety of considerations related to the supply chain. Communication among stakeholders is important during every step in the RMF and throughout the SDLC to ensure that security and privacy requirements are satisfied, concerns and issues are addressed expeditiously, and risk management processes are carried out effectively. References: [SP 800-39] (Organization Level); [SP 800-64]; [SP 800-160 v1] (Stakeholder Needs and Requirements Definition and Portfolio Management Processes); [SP 800-161]; [NIST CSF] (Core [Identify Function]).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > AUTHORIZE TASKS > TASK R-1

TASK R-1 Assemble the authorization package and submit the package to the authorizing official for an authorization decision. Potential Inputs: Security and privacy plans; security and privacy assessment reports; plan of action and milestones; supporting assessment evidence or other documentation, as required. Expected Outputs: Authorization package (with an executive summary), which may be generated from a security or privacy management tool94 for submission to the authorizing official. Primary Responsibility: System Owner; Common Control Provider; Senior Agency Official for Privacy.95 94 Organizations are encouraged to maximize the use of automated tools in the preparation, assembly, and transmission of authorization packages and security and privacy information supporting the authorization process. Many commercially available governance, risk, and compliance (GRC) tools can be employed to reduce or eliminate hard copy documentation. 95 The senior agency official for privacy is active for information systems processing PII.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK R-5

TASK R-5 Report the authorization decision and any deficiencies in controls that represent significant security or privacy risk. Potential Inputs: Authorization decision. Expected Outputs: A report indicating the authorization decision for a system or set of common controls; annotation of authorization status in the organizational system registry. Primary Responsibility: Authorizing Official or Authorizing Official Designated Representative. Supporting Roles: System Owner or Common Control Provider; Information Owner or Steward; System Security Officer; System Privacy Officer; Senior Agency Information Security Officer; Senior Agency Official for Privacy. System Development Life Cycle Phase: New - Implementation/Assessment. Existing - Operations/Maintenance. Discussion: Authorizing officials report authorization decisions for systems and common controls to designated organizational officials so the individual risk decisions can be viewed in the context of organization-wide security and privacy risk to organizational operations and assets, individuals, other organizations, and the Nation. Reporting occurs only in situations where organizations have delegated the authorization functions to levels of the organization below the head of agency. Authorizing officials also report exploitable deficiencies (i.e., vulnerabilities) in the system or controls noted during the assessment and continuous monitoring that represent significant security or privacy risk. Organizations determine, and the organizational policy reflects, what constitutes a significant security or privacy risk for reporting. Deficiencies that represent significant vulnerabilities and risk can be reported using the Subcategories, Categories, and Functions in the [NIST CSF]. Authorization decisions may be tracked and reflected as part of the organization-wide system registration process at the organization's discretion (see Task P-18). References: [SP 800-39] (Organization, Mission/Business Process, and System Levels); [SP 800-160 v1] (Decision Management and Project Assessment and Control Processes); [NIST CSF] (Core [Identify, Protect, Detect, Respond, Recover Functions]).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > SELECT TASKS > TASK S-1

TASK S-1 Select the controls for the system and the environment of operation. Potential Inputs: Security categorization; organization- and system-level risk assessment results; system element information; system component inventory; list of security and privacy requirements allocated to the system, system elements, and environment of operation; list of contractual requirements allocated to external providers of the system or system element; business impact analysis or criticality analysis; risk management strategy; organizational security and privacy policy; federal or organization-approved or mandated baselines or overlays; Cybersecurity Framework Profiles.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > TASK S-2

TASK S-2 Control Tailoring Tailor the controls selected for the system and the environment of operation. • System Owner • Common Control Provider • Authorizing Official or Authorizing Official Designated Representative • Information Owner or Steward • Systems Security Engineer • Privacy Engineer • System Security Officer • System Privacy Officer
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK S-5

TASK S-5 Develop and implement a system-level strategy for monitoring control effectiveness that is consistent with and supplements the organizational continuous monitoring strategy. Potential Inputs: Organizational risk management strategy; organizational continuous monitoring strategy; organization- and system-level risk assessment results; security and privacy plans; organizational security and privacy policies. Expected Outputs: Continuous monitoring strategy for the system including time-based trigger for ongoing authorization. Primary Responsibility: System Owner; Common Control Provider. Supporting Roles: Senior Accountable Official for Risk Management or Risk Executive (Function); Chief Information Officer; Senior Agency Information Security Officer; Senior Agency Official for Privacy; Authorizing Official or Authorizing Official Designated Representative; Information Owner or Steward; Security Architect; Privacy Architect; Systems Security Engineer; Privacy Engineer; System Security Officer; System Privacy Officer. System Development Life Cycle Phase: New - Development/Acquisition. Existing - Operations/Maintenance. Discussion: An important aspect of risk management is the ongoing monitoring of controls implemented within or inherited by an information system. An effective continuous monitoring strategy at the system level is developed and implemented in coordination with the organizational continuous monitoring strategy early in the SDLC (i.e., during initial system design or procurement decision). The system-level continuous monitoring strategy is consistent with and supplements the continuous monitoring strategy for the organization. The system-level strategy addresses monitoring those controls for which monitoring is not provided as part of the continuous monitoring strategy and implementation for the organization. The system-level strategy identifies the frequency of monitoring for controls not addressed by the organization-level strategy and defines the approach to be used for assessing those controls. The system- level continuous monitoring strategy, consistent with the organizational monitoring strategy, defines how changes to the system and the environment of operation81 are to be monitored; how risk assessments are 81 Changes to the operating environment (including the supply chain) may create vulnerabilities (e.g., availability of software patches, changes in supplier ownership providing services, maintenance, repair parts or other support).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK S-6

TASK S-6 Review and approve the security and privacy plans for the system and the environment of operation. Potential Inputs: Security and privacy plans; organization- and system-level risk assessment results. Expected Outputs: Security and privacy plans approved by the authorizing official. Primary Responsibility: Authorizing Official or Authorizing Official Designated Representative. Supporting Roles: Senior Accountable Official for Risk Management or Risk Executive (Function); Chief Information Officer; Chief Acquisition Officer; Senior Agency Information Security Officer; Senior Agency Official for Privacy. System Development Life Cycle Phase: New - Development/Acquisition. Existing - Operations/Maintenance. 82 The Privacy Continuous Monitoring (PCM) strategy includes all of the available privacy controls implemented throughout the organization at all risk management levels (i.e., organization, mission/business process, and system). The strategy ensures that the controls are monitored on an ongoing basis by assigning an organization-defined assessment frequency to each control that is sufficient to ensure compliance with applicable privacy requirements and to manage privacy risks. If, during the development of a new system, there is a need to create or use a privacy control not included in the PCM strategy, the senior agency official for privacy is consulted to determine whether it is appropriate for the proposed use case. If there is a decision to implement a new privacy control, the organization's PCM strategy is updated to include the new control with an organization-defined monitoring frequency. 83 Volatility is most prevalent in those controls implemented in the hardware, software and firmware elements of the system. For example, replacing or upgrading an operating system, a database system, application, or a network router may change the security controls provided by the vendor or original equipment manufacturer. Configuration settings may also require adjustments as organizational missions, business functions, threats, risks, and risk tolerance change.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER ONE > 1.1 PURPOSE AND APPLICABILITY

1.1 PURPOSE AND APPLICABILITY

NIST Special Publication 800-39 is the flagship document in the series of information security
standards and guidelines developed by NIST in response to FISMA. The purpose of Special
Publication 800-39 is to provide guidance for an integrated, organization-wide program for
managing information security risk to organizational operations (i.e., mission, functions, image,
and reputation), organizational assets, individuals, other organizations, and the Nation resulting
from the operation and use of federal information systems. Special Publication 800-39 provides a
structured, yet flexible approach for managing risk that is intentionally broad-based, with the
specific details of assessing, responding to, and monitoring risk on an ongoing basis provided by
other supporting NIST security standards and guidelines. The guidance provided in this
publication is not intended to replace or subsume other risk-related activities, programs,
processes, or approaches that organizations have implemented or intend to implement addressing
areas of risk management covered by other legislation, directives, policies, programmatic
initiatives, or mission/business requirements. Rather, the risk management guidance described
herein is complementary to and should be used as part of a more comprehensive Enterprise Risk
Management (ERM) program.
This publication satisfies the requirements of FISMA and meets or exceeds the information
security requirements established for executive agencies9 by the Office of Management and
Budget (OMB) in Circular A-130, Appendix III, Security of Federal Automated Information
Resources. The guidelines in this publication are applicable to all federal information systems
other than those systems designated as national security systems as defined in 44 U.S.C., Section
3542. The guidelines have been broadly developed from a technical perspective to complement
similar guidelines for national security systems and may be used for such systems with the
approval of appropriate federal officials exercising policy authority over such systems. State,
local, and tribal governments, as well as private sector organizations are encouraged to consider
using these guidelines, as appropriate.