Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
Executive Summary (part 1)

Executive Summary

As we push computers to "the edge," building a complex world of interconnected information
systems and devices, security and privacy risks (including supply chain risks) continue to be a
large part of the national conversation and topics of great importance. The significant increase
in the complexity of the hardware, software, firmware, and systems within the public and
private sectors (including the U.S. critical infrastructure) represents a significant increase in
attack surface that can be exploited by adversaries. Moreover, adversaries are using the supply
chain as an attack vector and effective means of penetrating our systems, compromising the
integrity of system elements, and gaining access to critical assets. The Defense Science Board Report, Resilient Military Systems and the Advanced Cyber Threat
[DSB 2013], provides a sobering assessment of the vulnerabilities in the United States
Government, the U.S. critical infrastructure, and the systems supporting the mission-essential
operations and assets in the public and private sectors. "...The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing
efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States
must lean significantly on deterrence to address the cyber threat posed by the most capable
U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber
deterrence is urgently needed..."
There is an urgent need to further strengthen the underlying information systems, component
products, and services that we depend on in every sector of the critical infrastructure-ensuring
that the systems, products, and services are sufficiently trustworthy throughout the system
development life cycle (SDLC) and can provide the necessary resilience to support the economic
and national security interests of the United States. System modernization, the increased use of
automation, and the consolidation, standardization, and optimization of federal systems and
networks to strengthen the protection for high value assets [OMB M-19-03], are key objectives
for the federal government. Executive Order (E.O.) 13800, Strengthening the Cybersecurity of Federal Networks and Critical
Infrastructure [EO 13800] recognizes the increasing interconnectedness of Federal information
systems and requires heads of agencies to ensure appropriate risk management not only for the
Federal agency's enterprise, but also for the Executive Branch as a whole. The E.O. states: "...The executive branch operates its information technology (IT) on behalf of the American people. Its IT and data should be secured responsibly using all United States Government capabilities..."
"...Cybersecurity risk management comprises the full range of activities undertaken to protect IT
and data from unauthorized access and other cyber threats, to maintain awareness of cyber
threats, to detect anomalies and incidents adversely affecting IT and data, and to mitigate the
impact of, respond to, and recover from incidents..."
OMB Memorandum M-17-25, Reporting Guidance for Executive Order on Strengthening the
Cybersecurity of Federal Networks and Critical Infrastructure [OMB M-17-25] provides
implementation guidance to Federal agencies for E.O. 13800. The memorandum states: "... An effective enterprise risk management program promotes a common understanding for
recognizing and describing potential risks that can impact an agency's mission and the delivery of
services to the public. Such risks include, but are not limited to, strategic, market, cyber, legal,
reputational, political, and a broad range of operational risks such as information security, human
capital, business continuity, and related risks..."
"... Effective management of cybersecurity risk requires that agencies align information security
management processes with strategic, operational, and budgetary planning processes..."
OMB Circular A-130, Managing Information as a Strategic Resource [OMB A-130], addresses
responsibilities for protecting federal information resources and for managing personally
identifiable information (PII). Circular A-130 requires agencies to implement the RMF that is
described in this guideline and requires agencies to integrate privacy into the RMF process. In
establishing requirements for information security programs and privacy programs, the OMB
circular emphasizes the need for both programs to collaborate on shared objectives: "While security and privacy are independent and separate disciplines, they are closely related, and it is
essential for agencies to take a coordinated approach to identifying and managing security and privacy
risks and complying with applicable requirements...."
This update to NIST Special Publication 800-37 (Revision 2) responds to the call by the Defense
Science Board, the Executive Order, and the OMB policy memorandum to develop the next-
generation Risk Management Framework (RMF) for information systems, organizations, and
individuals. There are seven major objectives for this update: •
To provide closer linkage and communication between the risk management processes and
activities at the C-suite or governance level of the organization and the individuals,
processes, and activities at the system and operational level of the organization; •
To institutionalize critical risk management preparatory activities at all risk management
levels to facilitate a more effective, efficient, and cost-effective execution of the RMF; •
To demonstrate how the NIST Cybersecurity Framework [NIST CSF] can be aligned with the
RMF and implemented using established NIST risk management processes; •
To integrate privacy risk management processes into the RMF to better support the privacy
protection needs for which privacy programs are responsible;