ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > MISSION OR BUSINESS OWNER

MISSION OR BUSINESS OWNER

The mission or business owner is the senior official or executive within an organization with
specific mission or line of business responsibilities and that has a security or privacy interest in
the organizational systems supporting those missions or lines of business. Mission or business
owners are key stakeholders that have a significant role in establishing organizational mission
and business processes and the protection needs and security and privacy requirements that
ensure the successful conduct of the organization's missions and business operations. Mission
and business owners provide essential inputs to the risk management strategy, play an active
part in the SDLC, and may also serve in the role of authorizing official.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > 2.3 INFORMATION SECURITY AND PRIVACY IN THE RMF > OMB CIRCULAR A-130: INTEGRATION OF INFORMATION SECURITY AND PRIVACY

OMB CIRCULAR A-130: INTEGRATION OF INFORMATION SECURITY AND PRIVACY

In 2016, OMB revised Circular A-130, the circular establishing general policy for the planning,
budgeting, governance, acquisition, and management of federal information, personnel,
equipment, funds, information technology resources, and supporting infrastructure and
services. The circular addresses responsibilities for protecting federal information resources and
managing personally identifiable information (PII). In establishing requirements for information
security programs and privacy programs, the circular emphasizes the need for both programs to
collaborate on shared objectives:
While security and privacy are independent and separate disciplines, they are closely related,
and it is essential for agencies to take a coordinated approach to identifying and managing
security and privacy risks and complying with applicable requirements.
[OMB A-130] requires organizations to implement the RMF that is described in this guideline.
With the 2016 revision to the circular, OMB also requires organizations to integrate privacy into
the RMF process:
The RMF provides a disciplined and structured process that integrates information security,
privacy, and risk management activities into the SDLC. This Circular requires organizations to
use the RMF to manage privacy risks beyond those that are typically included under the
"confidentiality" objective of the term "information security." While many privacy risks relate
to the unauthorized access or disclosure of PII, privacy risks may also result from other
activities, including the creation, collection, use, and retention of PII; the inadequate quality
or integrity of PII; and the lack of appropriate notice, transparency, or participation.
This section of the guideline describes the relationship between information security programs
and privacy programs under the RMF. However, subject to OMB policy, organizations retain the
flexibility to undertake the integration of privacy into the RMF in the most effective manner,
considering the organization's mission and circumstances.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > ONGOING AUTHORIZATION

ONGOING AUTHORIZATION

Continuous monitoring strategies148 promote effective and efficient risk management on an
ongoing basis. Risk management can become near real-time by using automation and state-of-
the-practice tools, techniques, and procedures for the ongoing monitoring of controls and
changes to systems and the environments in which those systems operate. Continuous
monitoring based on the needs of the authorizing official, produces the necessary information
to determine the security and privacy posture of the system149 and highlights the risks to
organizational operations and assets, individuals, other organizations, and the Nation.
Ultimately, continuous monitoring guides and informs the authorizing official's decision whether
to authorize the continued operation of the system or the continued use of the common
controls inherited by organizational systems.
Continuous monitoring helps to achieve a state of ongoing authorization where the authorizing
official maintains sufficient knowledge of the current security and privacy posture of the system
to determine whether continued operation is acceptable based on ongoing risk
determinations-and if not, which steps in the RMF need to be revisited to effectively respond
to the additional risk. Reauthorizations are unnecessary in situations where the continuous
monitoring program provides authorizing officials with the information necessary to manage the
risk arising from changes to the system or the environment in which the system operates. If a
reauthorization is required, organizations maximize the use of status reports and relevant
information about the security and privacy posture of the system that is produced during the
continuous monitoring process to improve efficiency.
When a system or common controls are under ongoing authorization, the system or common
controls may be authorized on a time-driven and/or event-driven basis, leveraging the security
and privacy information generated by the continuous monitoring program. The system and
148 [SP 800-137] provides additional guidance on information security continuous monitoring. Guidance on privacy
continuous monitoring will be provided in future publications.
149 For greater efficiency, the information security continuous monitoring (ISCM) and privacy continuous monitoring
(PCM) strategies may be consolidated into a single unified continuous monitoring strategy. Similarly, the ISCM and
PCM programs may also be consolidated into a single unified continuous monitoring program.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > Ongoing Authorization Frequency

Ongoing Authorization Frequency

[SP 800-53] security control CA-6, Part c. specifies that the authorization for a system and any
common controls inherited by the system be updated at an organization-established frequency.
This part of the control reinforces the concept of ongoing authorization. In accordance with CA-
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > ORGANIZATION AND SYSTEM PREPARATION

ORGANIZATION AND SYSTEM PREPARATION

Preparation can achieve effective, efficient, and cost-effective execution of risk management
processes. The primary objectives of the Prepare step include:
• Facilitate better communication between senior leaders and executives in the C-suite and
system owners and operators-
- aligning organizational priorities with resource allocation and prioritization at the system
level; and
- conveying acceptable limits regarding the selection and implementation of controls
within the established organizational risk tolerance.
• Promote organization-wide identification of common controls and the development of
organizationally-tailored control baselines, to reduce the workload on individual system
owners and the cost of system development and protection.
• Reduce the complexity of the IT infrastructure by consolidating, standardizing, and
optimizing systems, applications, and services through the application of enterprise
architecture concepts and models.
•
Identify, prioritize, and focus resources on high value assets (as defined in [OMB M-19-
03]), that require increased levels of protection.
• Facilitate system readiness for system-specific tasks.
These objectives, if achieved, significantly reduce the information technology footprint and the
attack surface of organizations, promote IT modernization objectives, and prioritize security and
privacy activities to focus protection strategies on the most critical assets and systems.
Finally, certain tasks in the Prepare step at the organization level are designated as optional.
These tasks are included to provide organizations additional options to help make their RMF
implementations more effective, efficient, and cost-effective.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > PREPARE TASKS—ORGANIZATION LEVEL

PREPARE TASKS-ORGANIZATION LEVEL

Table 1 provides a summary of tasks and expected outcomes for the RMF Prepare
step at the organization level. Applicable Cybersecurity Framework constructs are also
provided.
TABLE 1: PREPARE TASKS AND OUTCOMES-ORGANIZATION LEVEL
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > PREPARE TASKS—ORGANIZATION LEVEL > Purpose

Purpose

The purpose of the Prepare step is to carry out essential activities at the organization,
mission and business process, and information system levels of the organization to
help prepare the organization to manage its security and privacy risks using the Risk
Management Framework.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > ASSESS TASKS > Purpose

ASSESS TASKS

Table 6 provides a summary of tasks and expected outcomes for the RMF Assess step.
Applicable Cybersecurity Framework constructs are also provided.
TABLE 6: ASSESS TASKS AND OUTCOMES

Purpose

The purpose of the Assess step is to determine if the controls selected for implementation are
implemented correctly, operating as intended, and producing the desired outcome with respect
to meeting the security and privacy requirements for the system and the organization.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > MONITOR TASKS > Purpose

MONITOR TASKS

Table 8 provides a summary of tasks and expected outcomes for the RMF Monitor step.
Applicable Cybersecurity Framework constructs are also provided.
TABLE 8: MONITOR TASKS AND OUTCOMES

Purpose

The purpose of the Monitor step is to maintain an ongoing situational awareness about the
security and privacy posture of the information system and the organization in support of risk
management decisions.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX A > REFERENCES

REFERENCES

LAWS, POLICIES, DIRECTIVES, REGULATIONS, STANDARDS, AND GUIDELINES
LAWS AND EXECUTIVE ORDERS
[32 CFR 2002.4]
Title 32 Code of Federal Regulations, Sec. 2002.4, Definitions. 2018 ed.
https://www.govinfo.gov/app/details/CFR-2018-title32-vol6/CFR-2018-title32-
vol6-sec2002-4
[40 USC 11331]
Title 40 U.S. Code, Sec. 11331, Responsibilities for Federal information
systems standards. 2017 ed.
https://www.govinfo.gov/app/details/USCODE-2017-title40/USCODE-2017-title40-
subtitleIII-chap113-subchapIII-sec11331
[44 USC 3301]
Title 44 U.S. Code, Sec. 3301, Definition of records. 2017 ed.
https://www.govinfo.gov/app/details/USCODE-2017-title44/USCODE-2017-title44-
chap33-sec3301
[44 USC 3502]
Title 44 U.S. Code, Sec. 3502, Definitions. 2017 ed.
https://www.govinfo.gov/app/details/USCODE-2017-title44/USCODE-2017-title44-
chap35-subchapI-sec3502
[44 USC 3552]
Title 44 U.S. Code, Sec. 3552, Definitions. 2017 ed.
https://www.govinfo.gov/app/details/USCODE-2017-title44/USCODE-2017-title44-
chap35-subchapII-sec3552
[44 USC 3554]
Title 44 U.S. Code, Sec. 3554, Federal agency responsibilities. 2017 ed.
https://www.govinfo.gov/app/details/USCODE-2017-title44/USCODE-2017-title44-
chap35-subchapII-sec3554
[44 USC 3601]
Title 44 U.S. Code, Sec. 3601, Definitions. 2017 ed.
https://www.govinfo.gov/app/details/USCODE-2017-title44/USCODE-2017-title44-
chap36-sec3601
[PRIVACT]
Privacy Act (P.L. 93-579), December 1974.
https://www.govinfo.gov/app/details/STATUTE-88/STATUTE-88-Pg1896
[FOIA96]
Freedom of Information Act (FOIA), 5 U.S.C. § 552, As Amended By Public
Law No. 104-231, 110 Stat. 3048, Electronic Freedom of Information Act
Amendments of 1996.
https://www.govinfo.gov/app/details/PLAW-104publ231
[FISMA]
Federal Information Security Modernization Act (P.L. 113-283), December
2014.
https://www.govinfo.gov/app/details/PLAW-113publ283
[EO 13800]
Executive Order 13800, Strengthening the Cybersecurity of Federal
Networks and Critical Infrastructure, May 2017.
https://www.govinfo.gov/app/details/FR-2017-05-16/2017-10004
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > RISK EXECUTIVE (FUNCTION)

RISK EXECUTIVE (FUNCTION)

The risk executive (function) is an individual or group within an organization that provides a
comprehensive, organization-wide approach to risk management. The risk executive (function)
is led by the senior accountable official for risk management and serves as the common risk
management resource for senior leaders, executives, and managers, mission/business owners,
chief information officers, senior agency information security officers, senior agency officials for
privacy, system owners, common control providers, enterprise architects, security architects,
systems security or privacy engineers, system security or privacy officers, and any other
stakeholders having a vested interest in the mission/business success of organizations. The risk
executive (function) is an inherent U.S. Government function and is assigned to government
personnel only.
The risk executive (function) ensures that risk considerations for systems (including
authorization decisions for those systems and the common controls inherited by those systems),
are viewed from an organization-wide perspective regarding the organization's strategic goals
and objectives in carrying out its core missions and business functions. The risk executive
(function) ensures that managing risk is consistent throughout the organization, reflects
organizational risk tolerance, and is considered along with other types of risk to ensure
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX H > SYSTEM LIFE CYCLE CONSIDERATIONS > RISK MANAGEMENT IN THE SYSTEM DEVELOPMENT LIFE CYCLE

RISK MANAGEMENT IN THE SYSTEM DEVELOPMENT LIFE CYCLE

Risk management activities begin early in the SDLC and continue throughout the life cycle. These
activities are important in helping to shape the security and privacy capabilities of the system;
ensuring that the necessary controls are implemented and that the security and privacy risks are
being adequately addressed on an ongoing basis; and ensuring that the authorizing officials
understand the current security and privacy posture of the system in order to accept the risk to
organizational operations and assets, individuals, other organizations, and the Nation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > THE PROCESS > RMF ALIGNMENT WITH THE SDLC

RMF ALIGNMENT WITH THE SDLC

The best RMF implementation is one that is indistinguishable from the routine SDLC processes
carried out by organizations. That is, RMF tasks are closely aligned with the ongoing activities in
the SDLC processes, ensuring the seamless integration of security and privacy protections into
organizational systems-and taking maximum advantage of the artifacts generated by the SDLC
processes to produce the necessary evidence in authorization packages to facilitate credible,
risk-based decision making by senior leaders in organizations.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > ROLES AND RESPONSIBILITIES

CNSS

Committee on National Security Systems

CNSSI

Committee on National Security Systems Instruction

CNSSP

Committee on National Security Systems Policy

CUI

Controlled Unclassified Information
DoD
Department of Defense

EO

Executive Order
FedRAMP
Federal Risk and Authorization Management Program

FIPS

Federal Information Processing Standards

FISMA

Federal Information Security Modernization Act

FOCI

Foreign Ownership, Control, or Influence

IEC

International Electrotechnical Commission

IEEE

Institute of Electrical and Electronics Engineers

ISCM

Information Security Continuous Monitoring

IR

Internal Report or Interagency Report

ISO

International Organization for Standardization

NARA

National Archives and Records Administration

ODNI

Office of the Director of National Intelligence

PII

Personally Identifiable Information

SDLC

System Development Life Cycle
SecCM
Security-focused Configuration Management

ROLES AND RESPONSIBILITIES

KEY PARTICIPANTS IN THE RISK MANAGEMENT PROCESS
he following sections describe the roles and responsibilities of key participants involved in
an organization's risk management process.112 Recognizing that organizations have varying
missions, business functions, and organizational structures, there may be differences in
naming conventions for risk management roles and how risk management responsibilities are
allocated among organizational personnel (e.g., multiple individuals filling a single role or one
individual filling multiple roles).113 However, the basic functions remain the same. The
application of the RMF described in this publication is flexible, allowing organizations to
effectively accomplish the intent of the specific tasks within their respective organizational
structures to best manage security and privacy risks. Many risk management roles defined in
this publication have counterpart roles in the SDLC processes carried out by organizations.
Organizations align their risk management roles with similar (or complementary) roles defined
for the SDLC whenever possible.114
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SECURITY OR PRIVACY ARCHITECT

SECURITY OR PRIVACY ARCHITECT

The security or privacy architect is an individual, group, or organization responsible for ensuring
that stakeholder protection needs and the corresponding system requirements necessary to
protect organizational missions and business functions and individuals' privacy are adequately
addressed in the enterprise architecture including reference models, segment architectures, and
solution architectures (systems supporting mission and business processes). The security or
privacy architect serves as the primary liaison between the enterprise architect and the systems
security or privacy engineer and coordinates with system owners, common control providers,
and system security or privacy officers on the allocation of controls.
Security or privacy architects, in coordination with system security or privacy officers, advise
authorizing officials, chief information officers, senior accountable officials for risk management
or risk executive (function), senior agency information security officers, and senior agency
officials for privacy on a range of security and privacy issues. Examples include establishing
authorization boundaries; establishing security or privacy alerts; assessing the severity of
deficiencies in the system or controls; developing plans of action and milestones; creating risk
mitigation approaches; and potential adverse effects of identified vulnerabilities or privacy risks.
When the security architect and privacy architect are separate roles, the security architect is
generally responsible for aspects of the enterprise architecture that protect information and
information systems from unauthorized system activity or behavior to provide confidentiality,
integrity, and availability. The privacy architect is responsible for aspects of the enterprise
architecture that ensure compliance with privacy requirements and manage the privacy risks to
individuals associated with the processing of PII. Security and privacy architect responsibilities
overlap regarding aspects of the enterprise architecture that protect the security of PII.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SENIOR ACCOUNTABLE OFFICIAL FOR RISK MANAGEMENT

SENIOR ACCOUNTABLE OFFICIAL FOR RISK MANAGEMENT

The senior accountable official for risk management is the individual that leads and manages the
risk executive (function) in an organization and is responsible for aligning information security
and privacy risk management processes with strategic, operational, and budgetary planning
processes. The senior accountable official for risk management is the head of the agency or an
individual designated by the head of the agency. The senior accountable official for risk
management determines the organizational structure and responsibilities of the risk executive
(function), and in coordination with the head of the agency, may retain the risk executive
(function) or delegate the function to another organizational official or group. The senior
accountable official for risk management is an inherent U.S. Government function and is
assigned to government personnel only.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SENIOR AGENCY INFORMATION SECURITY OFFICER

SENIOR AGENCY INFORMATION SECURITY OFFICER

The senior agency information security officer is an organizational official responsible for
carrying out the chief information officer security responsibilities under FISMA, and serving as
the primary liaison for the chief information officer to the organization's authorizing officials,
system owners, common control providers, and system security officers. The senior agency
information security officer is also responsible for coordinating with the senior agency official
for privacy to ensure coordination between privacy and information security programs. The
senior agency information security officer possesses the professional qualifications, including
training and experience, required to administer security program functions; maintains security
duties as a primary responsibility; and heads an office with the specific mission and resources to
assist the organization in achieving trustworthy, secure information and systems in accordance
with the requirements in FISMA. The senior agency information security officer may serve as
authorizing official designated representative or as a security control assessor. The role of senior
agency information security officer is an inherent U.S. Government function and is therefore
assigned to government personnel only. Organizations may also refer to the senior agency
information security officer as the senior information security officer or chief information
security officer.