Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

System Development Life Cycle Phase: New - Development/Acquisition; Implementation/Assessment.
Existing - Operations/Maintenance.
Discussion: Organizations implement the controls as described in the security and privacy plans. The
control implementation is consistent with the organization's enterprise architecture and associated
security and privacy architectures. Organizations use best practices when implementing controls,
including systems security and privacy engineering methodologies, concepts, and principles. Risk
assessments guide and inform decisions regarding the cost, benefit, and risk trade-offs in using different
technologies or policies for control implementation. Organizations also ensure that mandatory
configuration settings are established and implemented on system elements in accordance with federal
and organizational policies. When organizations have no direct control over what controls are
implemented in a system element, for example, in commercial off-the-shelf products, organizations
consider the use of system elements that have been tested, evaluated, or validated by approved,
independent, third-party assessment facilities (e.g., NIST Cryptographic Module Validation Program
Testing Laboratories, National Information Assurance Partnership Common Criteria Testing Laboratories).
The tests, evaluations, and validations consider products in specific configurations and in isolation; control
implementation addresses how the product is integrated into the system while preserving security
functionality and assurance.
Organizations also address, where applicable, assurance requirements when implementing controls.
Assurance requirements are directed at the activities that control developers and implementers carry out
to increase the level of confidence that the controls are implemented correctly, operating as intended,
and producing the desired outcome with respect to meeting the security and privacy requirements for the
system. The assurance requirements address quality of the design, development, and implementation of
the controls.85
For the common controls inherited by the system, systems security and privacy engineers with support
from system security and privacy officers, coordinate with the common control provider to determine the
most appropriate way to implement common controls. System owners can refer to the authorization
packages prepared by common control providers when making determinations regarding the adequacy of
common controls inherited by their systems. During implementation, it may be determined that common
controls previously selected to be inherited by the system do not meet the specified security or privacy
requirements for the system. For common controls that do not meet the requirements for the system
inheriting the controls or when common controls have unacceptable deficiencies, the system owners
identify compensating or supplementary controls to be implemented. System owners can supplement the
common controls with system-specific or hybrid controls to achieve the required protection for their
systems or they can accept greater risk with the acknowledgement and approval of the organization. Risk
assessments may determine how gaps in security or privacy requirements between systems and common
controls affect the risk associated with the system, and how to prioritize the need for compensating or
supplementary controls to mitigate specific risks.
Consistent with the flexibility allowed in applying the tasks in the RMF, organizations conduct initial
control assessments during system development and implementation. Conducting such assessments in
parallel with the development and implementation phases of the SDLC facilitates early identification of
deficiencies and provides a cost-effective method for initiating corrective actions. Issues discovered
during these assessments can be referred to authorizing officials for resolution. The results of the initial
control assessments can also be used during the authorize step to avoid delays or costly repetition of
assessments. Assessment results that are subsequently reused in other phases of the SDLC meet the
reuse requirements established by the organization.86
85 [SP 800-53] provides a list of assurance-related security and privacy controls.
86 See the RMF Assess step and [SP 800-53A] for information on assessments and reuse of assessment results.