ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Primary Responsibility: Authorizing Official.
Supporting Roles: Senior Accountable Official for Risk Management or Risk Executive (Function); Chief
Information Officer; Senior Agency Information Security Officer; Senior Agency Official for Privacy;
Authorizing Official Designated Representative.
System Development Life Cycle Phase: New - Operations/Maintenance.
Existing - Operations/Maintenance.
Discussion: To employ an ongoing authorization approach, organizations have in place an organization-
level and system-level continuous monitoring process to assess implemented controls on an ongoing
basis.111 The findings or results from the continuous monitoring process provides useful information to
authorizing officials to support near-real time risk-based decision making. In accordance with the
guidance in Task R-4, the authorizing official or designated representative reviews the security and privacy
posture of the system (including the effectiveness of the implemented controls) on an ongoing basis to
determine the current risk to organizational operations and assets, individuals, other organizations, and
the Nation. The authorizing official determines whether the current risk is acceptable and provides
appropriate direction to the system owner or common control provider. The authorizing official may
determine that the risk remains at an acceptable level for continued operation or that the risk is no longer
at an acceptable level for continued operation, and may issue a denial of authorization to operate,
authorization to use, or common control authorization.
The risks may change based on the information provided in the security and privacy posture reports
because the reports may indicate changes to the security or privacy risk factors. Determining how
changing conditions affect organizational and individual risk is essential for managing privacy risk and
maintaining adequate security. By carrying out ongoing risk determination and risk acceptance,
authorizing officials can maintain system and common control authorizations over time and transition to
ongoing authorization. Reauthorization actions occur only in accordance with federal or organizational
policies. The authorizing official conveys updated risk determination and acceptance results to the senior
accountable official for risk management or the risk executive (function).
The use of automated support tools to capture, organize, quantify, visually display, and maintain security
and privacy posture information promotes near real-time risk management regarding the risk posture of
the organization. The use of metrics and dashboards increases an organization's capability to make risk-
based decisions by consolidating data in an automated fashion and providing the data to decision makers
at different levels within the organization in an easy-to-understand format.
References: [SP 800-30]; [SP 800-39] (Organization, Mission/Business Process, and System Levels); [SP
800-55]; [SP 800-160 v1] (Risk Management Process); [IR 8011 v1]; [IR 8062].
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Management or Risk Executive (Function); Senior Agency Information Security Officer; Senior Agency
Official for Privacy.
System Development Life Cycle Phase: New - Not Applicable.
Existing - Disposal.
Discussion: When a system is removed from operation, several risk management actions are required.
Organizations ensure that controls addressing system disposal are implemented. Examples include media
sanitization; configuration management and control; component authenticity; and record retention.
Organizational tracking and management systems (including inventory systems) are updated to indicate
the system that is being removed from service. Security and privacy posture reports reflect the security
and privacy status of the system. Users and application owners hosted on the disposed system are
notified as appropriate, and any control inheritance relationships are reviewed and assessed for impact.
This task also applies to system elements that are removed from operation. Organizations removing a
system from operation update the inventory of information systems to reflect the removal. System
owners and security personnel ensure that disposed systems comply with relevant federal laws,
regulations, directives, policies, and standards.
References: [SP 800-30]; [SP 800-88]; [IR 8062].
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Supporting Roles: Senior Accountable Official for Risk Management or Risk Executive (Function); Chief
Information Officer; Senior Agency Information Security Officer.
System Development Life Cycle Phase: New - Initiation (concept/requirements definition).
Existing - Operations/Maintenance.
Discussion: For information systems that process PII, the senior agency official for privacy reviews and
approves the security categorization results and decision prior to the authorizing official's review.76
Security categorization results and decisions are reviewed by the authorizing official or a designated
representative to ensure that the security category selected for the information system is consistent with
the mission and business functions of the organization and the need to adequately protect those missions
and functions. The authorizing official or designated representative reviews the categorization results and
decision from an organization-wide perspective, including how the decision aligns with the categorization
decisions for all other organizational systems. The authorizing official collaborates with the senior
accountable official for risk management or the risk executive (function) to ensure that the categorization
decision for the system is consistent with the organizational risk management strategy and satisfies
requirements for high value assets. As part of the approval process, the authorizing official can provide
specific guidance to the system owner with respect to any limitations on baseline tailoring activities for
the system that occur at the RMF Select step (see Task S-2). If the security categorization decision is not
approved, the system owner initiates steps to repeat the categorization process and resubmits the
adjusted results to the authorizing official or designated representative. System registration information is
subsequently updated with the approved security categorization information (see Task P-18).
References: [FIPS 199]; [SP 800-30]; [SP 800-39] (Organization Level); [SP 800-160 v1] (Stakeholder Needs
and Requirements Definition Process); [CNSSI 1253]; [NIST CSF] (Core [Identify Function]).
76 The responsibilities of the senior agency official for privacy are detailed in [OMB A-130].
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Discussion: The security and privacy plan review by the authorizing official or designated representative
with support from the senior accountable official for risk management or risk executive (function), chief
information officer, senior agency information security officer, and senior agency official for privacy,
determines if the plans are complete, consistent, and satisfy the stated security and privacy requirements
for the system. Based on the results from this review, the authorizing official or designated representative
may recommend changes to the security and privacy plans. If the plans are unacceptable, the system
owner or common control provider make appropriate changes to the plans. If the plans are acceptable,
the authorizing official or designated representative approves the plans.
The acceptance of the security and privacy plans represents an important milestone in the SDLC and risk
management process. The authorizing official or designated representative, by approving the plans,
agrees to the set of controls (i.e., system-specific, hybrid, or common controls) and the description of the
proposed implementation of the controls to meet the security and privacy requirements for the system
and the environment in which the system operates.84 The approval of the plans allows the risk
management process to proceed to the RMF Implement step. The approval of the plans also establishes
the level of effort required to successfully complete the remainder of the RMF steps and provides the
basis of the security and privacy specifications for the acquisition of the system or individual system
elements.
References: [SP 800-30]; [SP 800-53]; [SP 800-160 v1] (System Requirements Definition, Architecture
Definition, and Design Definition Processes).
84 After the initial review and approval of the system security plan by the authorizing official, any subsequent
authorization-related actions (e.g., reauthorizations or ongoing authorizations) provide an inherent review and
approval of the system security plan since it is included in the authorization package.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO

•
Identifying, aligning, and deconflicting security and privacy requirements; and
•
Allocating security and privacy requirements to information systems, system elements, and
organizations.
In contrast to the Level 1 and 2 activities that prepare the organization for the execution of the
RMF, Level 3 addresses risk from an information system perspective and is guided and informed
by the risk decisions at the organization and mission/business process levels. The risk decisions
at Levels 1 and 2 can impact the selection and implementation of controls at the system level.
Controls are designated by the organization as system-specific, hybrid, or common (inherited)
controls in accordance with the enterprise architecture, security or privacy architecture, and any
tailored control baselines or overlays that have been developed by the organization.24
Organizations establish traceability of controls to the security and privacy requirements that the
controls are intended to satisfy. Establishing such traceability ensures that all requirements are
addressed during system design, development, implementation, operations, maintenance, and
disposition.25 Each level of the risk management hierarchy is a beneficiary of a successful RMF
execution-reinforcing the iterative nature of the risk management process where security and
privacy risks are framed, assessed, responded to, and monitored at various organizational levels.
Without adequate risk management preparation at the organizational level, security and privacy
activities can become too costly, demand too many skilled security and privacy professionals,
and produce ineffective solutions. For example, organizations that fail to implement an effective
enterprise architecture will have difficulty in consolidating, optimizing, and standardizing their
information technology infrastructures. Additionally, the effect of architectural and design
decisions can adversely affect the ability of organizations to implement effective security and
privacy solutions. A lack of adequate preparation by organizations could result in unnecessary
redundancy as well as inefficient, costly and vulnerable systems, services, and applications.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO

•
Select an initial set of controls for the system and tailor the controls as needed to reduce
risk to an acceptable level based on an assessment of risk.
•
Implement the controls and describe how the controls are employed within the system and
its environment of operation.
•
Assess the controls to determine if the controls are implemented correctly, operating as
intended, and producing the desired outcomes with respect to satisfying the security and
privacy requirements.
•
Authorize the system or common controls based on a determination that the risk to
organizational operations and assets, individuals, other organizations, and the Nation is
acceptable.
•
Monitor the system and the associated controls on an ongoing basis to include assessing
control effectiveness, documenting changes to the system and environment of operation,
conducting risk assessments and impact analyses, and reporting the security and privacy
posture of the system.
Figure 2 illustrates the steps in the RMF. The RMF operates at all levels in the risk management
hierarchy illustrated in Figure 1. Chapter Three provides a detailed description of each of the
tasks necessary to carry out the steps in the RMF.
FIGURE 2: RISK MANAGEMENT FRAMEWORK
While the RMF steps are listed in sequential order above and in Chapter Three, the steps
following the Prepare step can be carried out in a nonsequential order. After completing the
tasks in the Prepare step, organizations executing the RMF for the first time for a system or set
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO

Figure 5 illustrates the conceptual view of the system and the relationships among the system,
system elements, enabling systems, other systems, and the environment of operation.38
FIGURE 5: CONCEPTUAL VIEW OF THE SYSTEM
Certain parts of the environment of operation may be included in the authorization boundary
(i.e., determined to be "in scope" for the authorization) while other parts may be excluded. For
example, if the facility (i.e., environment of operation) that provides protection for the system
elements is determined to be in scope for the authorization of the system, the physical and
environmental protection controls (e.g., physical access controls at entry points, perimeter
protection devices) are included in the authorization boundary and therefore, are included in
the system security plan. If the facility provides physical and environmental protections as
common controls to be inherited by the system, the environment of operation is out of scope
for the system and is not included in the authorization boundary for the system.39
The system may also communicate or have other interactions with enabling systems and other
systems that are part of the extended environment of operation but are outside of the scope of
authorization for the system.40 Organizations determine which parts of the environment of
operation are within the authorization boundary. These determinations are typically specific to
the system and are context-driven.
38 The terms system, system element, enabling system, other systems, and the environment of operation are agnostic
with respect to information technology (IT) and operations technology (OT).
39 Common controls are referenced in the security and privacy plans for the system inheriting the controls.
40 For connections and information exchange between the system and the enabling or other systems outside of the
authorization boundary, organizations consider the risks introduced by such connections and information exchange.
ENVIRONMENT OF OPERATION
Enabling
System
Enabling
System
Enabling
System
Enabling
System
System
Element
System
Element
System
Element
SYSTEM
(AUTHORIZATION BOUNDARY)
Other
System
Other
System
Other
System
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
describes the concepts associated with managing information system-related

1.4 ORGANIZATION OF THIS PUBLICATION

The remainder of this special publication is organized as follows:
•

describes the concepts associated with managing information system-related

security and privacy risk. This includes an organization-wide view of risk management; the
RMF steps and task structure; the relationship between information security and privacy
programs and how these programs are addressed in the RMF; information resources as
system and system elements; authorization boundaries; security and privacy posture; and
security and privacy considerations related to supply chain risk management.
•
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > CHIEF ACQUISITION OFFICER

CHIEF ACQUISITION OFFICER

The chief acquisition officer is an organizational official designated by the head of an agency to
advise and assist the head of agency and other agency officials to ensure that the mission of the
agency is achieved through the management of the agency's acquisition activities. The chief
acquisition officer monitors the performance of acquisition activities and programs; establishes
clear lines of authority, accountability, and responsibility for acquisition decision making within
the agency; manages the direction and implementation of acquisition policy for the agency; and
establishes policies, procedures, and practices that promote full and open competition from
responsible sources to fulfill best value requirements considering the nature of the property or
service procured. The Chief Acquisition Officer coordinates with mission or business owners,
authorizing officials, senior accountable official for risk management, system owners, common
control providers, senior agency information security officer, senior agency official for privacy,
and risk executive (function) to ensure that security and privacy requirements are defined in
organizational procurements and acquisitions.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > CHIEF INFORMATION OFFICER

CHIEF INFORMATION OFFICER

The chief information officer117 is an organizational official responsible for designating a senior
agency information security officer; developing and maintaining security policies, procedures,
and control techniques to address security requirements; overseeing personnel with significant
responsibilities for security and ensuring that the personnel are adequately trained; assisting
senior organizational officials concerning their security responsibilities; and reporting to the
head of the agency on the effectiveness of the organization's security program, including
progress of remedial actions. The chief information officer, with the support of the senior
accountable official for risk management, the risk executive (function), and the senior agency
information security officer, works closely with authorizing officials and their designated
representatives to help ensure that:
116 [OMB A-130] provides additional information about authorizing officials and co-authorizing officials.
117 When an organization has not designated a formal chief information officer position, [FISMA] requires that the
associated responsibilities be handled by a comparable organizational official.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > Common Control Authorization

Common Control Authorization

A common control authorization is similar to an authorization to operate for systems. If the
authorizing official, after reviewing the authorization package submitted by the common control
provider, determines that the risk to organizational operations and assets, individuals, other
organizations, and the Nation is acceptable, a common control authorization is issued. It is the
responsibility of common control providers to indicate that the common controls selected by
the organization have been implemented, assessed, and authorized and are available for
inheritance by organizational systems. Common control providers are also responsible for
ensuring that the system owners inheriting the controls have access to appropriate
documentation and tools.
Common controls are authorized for a specific time period in accordance with the terms and
conditions established by the authorizing official and the organization. An authorization
termination date is established by the authorizing official as a condition of the initial common
control authorization. The termination date can be adjusted at any time to reflect the level of
concern by the authorizing official regarding the security and privacy posture of the common
controls that are available for inheritance. If the controls are under ongoing authorization, a
137 Formerly referred to as an interim authority to test.
138 Additional information on event-driven triggers is provided below.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > COMMON CONTROL PROVIDER

COMMON CONTROL PROVIDER

The common control provider is an individual, group, or organization that is responsible for the
implementation, assessment, and monitoring of common controls (i.e., controls inherited by
organizational systems).118 Common control providers also are responsible for ensuring the
documentation of organization-defined common controls in security and privacy plans (or
equivalent documents prescribed by the organization); ensuring that required assessments of
the common controls are conducted by qualified assessors with an appropriate level of
independence; documenting assessment findings in control assessment reports; and producing
plans of action and milestones for controls having deficiencies. Security and privacy plans,
security and privacy assessment reports, and plans of action and milestones for common
controls (or summary of such information) are made available to the system owners of systems
inheriting common controls after the information is reviewed and approved by the authorizing
officials accountable for those common controls.
The senior agency official for privacy is responsible for designating which privacy controls may
be treated as common controls. Privacy controls that are designated as common controls are
documented in the organization's privacy program plan.119 The senior agency official for privacy
118 Organizations can have multiple common control providers depending on how security and privacy responsibilities
are allocated organization-wide. Common control providers may be system owners when the common controls are
resident within an organizational system.
119 A privacy program plan is a formal document that provides an overview of an agency's privacy program, including a
description of the structure of the privacy program; the role of the senior agency official for privacy and other privacy
officials and staff; the strategic goals and objectives of the privacy program; the resources dedicated to the privacy
program; and the program management controls and common controls in place or planned for meeting applicable
privacy requirements and managing privacy risks.