ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SENIOR AGENCY OFFICIAL FOR PRIVACY

SENIOR AGENCY OFFICIAL FOR PRIVACY

The senior agency official for privacy is the senior official or executive with agency-wide
responsibility and accountability for ensuring compliance with applicable privacy requirements
and managing privacy risk. Among other things, the senior agency official for privacy is
responsible for:
•
Coordinating with the senior agency information security officer to ensure coordination of
privacy and information security activities;
•
Reviewing and approving the categorization of information systems that create, collect, use,
process, store, maintain, disseminate, disclose, or dispose of personally identifiable
information;
•
Designating which privacy controls will be treated as program management, common,
system-specific, and hybrid privacy controls;
•
Identifying assessment methodologies and metrics to determine whether privacy controls
are implemented correctly, operating as intended, and sufficient to ensure compliance with
applicable privacy requirements and manage privacy risks;
•
Reviewing and approving privacy plans for information systems prior to authorization,
reauthorization, or ongoing authorization;
•
Reviewing authorization packages for information systems that create, collect, use, process,
store, maintain, disseminate, disclose, or dispose of personally identifiable information to
ensure compliance with privacy requirements and manage privacy risks;
•
Conducting and documenting the results of privacy control assessments to verify the
continued effectiveness of all privacy controls selected and implemented at the agency; and
•
Establishing and maintaining a privacy continuous monitoring program to maintain ongoing
awareness of privacy risks and assess privacy controls at a frequency sufficient to ensure
compliance with privacy requirements and manage privacy risks.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX E > SUMMARY OF RMF TASKS

SUMMARY OF RMF TASKS

RMF TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES
TABLE E-1: PREPARE TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES
RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES
Organization Level
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > SUPPLY CHAIN RISK MANAGEMENT STRATEGIES AND PLANS

SUPPLY CHAIN RISK MANAGEMENT STRATEGIES AND PLANS

Organizations have flexibility on how the details of SCRM strategies and plans are documented.
SCRM strategy details for Levels 1 and 2 (organization and mission/business process levels), can
be documented in the information security program plan for the organization or in a separate
organization-level and/or mission/business process-level SCRM strategy. SCRM plan details for
Level 3 (information system level) can be documented in the information system security plan
or in a separate system-level SCRM plan. An SCRM strategy template is provided in [SP 800-161].
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SYSTEM ADMINISTRATOR

APPENDIX D

The role of senior agency official for privacy is an inherent U.S. Government function and is
therefore assigned to government personnel only.

SYSTEM ADMINISTRATOR

The system administrator is an individual, group, or organization responsible for setting up and
maintaining a system or specific system elements. System administrator responsibilities include,
for example, installing, configuring, and updating hardware and software; establishing and
managing user accounts; overseeing or conducting backup, recovery, and reconstitution
activities; implementing controls; and adhering to and enforcing organizational security and
privacy policies and procedures. The system administrator role includes other types of system
administrators (e.g., database administrators, network administrators, web administrators, and
application administrators).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > SYSTEM AND COMMON CONTROL AUTHORIZATIONS

APPENDIX E

RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

TABLE E-2: CATEGORIZATION TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES
RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

TABLE E-4: IMPLEMENTATION TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES
RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

TABLE E-5: ASSESSMENT TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES
RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

APPENDIX E

TABLE E-6: AUTHORIZATION TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES
RMF TASKS
PRIMARY RESPONSIBILITY
SUPPORTING ROLES

SYSTEM AND COMMON CONTROL AUTHORIZATIONS

AUTHORIZATION DECISIONS AND SUPPORTING EVIDENCE
his appendix provides information on the system and common control authorization
processes to include: types of authorizations; content of authorization packages;
authorization decisions; authorization decision documents; ongoing authorization;
reauthorization; event-driven triggers and significant changes; type and facility authorizations;
and authorization approaches.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX H > SYSTEM LIFE CYCLE CONSIDERATIONS

SYSTEM LIFE CYCLE CONSIDERATIONS

OTHER FACTORS EFFECTING THE EXECUTION OF THE RMF
ll systems, including operational systems, systems under development, and systems that
are undergoing modification or upgrade, are in some phase of the SDLC.166 Defining
requirements is a critical part of an SDLC process and begins in the initiation phase.167
Security and privacy requirements are part of the functional and nonfunctional168 requirements
allocated to a system. The security and privacy requirements are incorporated into the SDLC
simultaneously with the other requirements. Without the early integration of security and
privacy requirements, significant expense may be incurred by the organization later in the life
cycle to address security and privacy concerns that could have been included in the initial
design. When security and privacy requirements are defined early in the SDLC and integrated
with other system requirements, the resulting system has fewer deficiencies, and therefore,
fewer privacy risks or security vulnerabilities that can be exploited in the future.
Integrating security and privacy requirements into the SDLC is the most effective, efficient, and
cost-effective method to ensure that the organization's protection strategy is implemented. It
also ensures that security and privacy processes are not isolated from the other processes used
by the organization to develop, implement, operate, and maintain the systems supporting
ongoing missions and business functions. In addition to incorporating security and privacy
requirements into the SDLC, the requirements are integrated into the organization's program,
planning, and budgeting activities to help ensure that resources are available when needed and
program and project milestones are completed. The enterprise architecture provides a central
record of this integration within an organization.
Ensuring that security and privacy requirements are integrated into the SDLC helps facilitate the
development and implementation of more resilient systems to reduce the security and privacy
166 There are five phases in the SDLC including initiation; development and acquisition; implementation; operation
and maintenance; and disposal. [SP 800-64] provides guidance on the SDLC.
167 Organizations may employ a variety of development processes (e.g., waterfall, spiral, or agile).
168 Nonfunctional requirements include, for example, quality and assurance requirements.
A
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SYSTEM OWNER

SYSTEM OWNER

The system owner is an organizational official responsible for the procurement, development,
integration, modification, operation, maintenance, and disposal of a system.121 The system
owner is responsible for addressing the operational interests of the user community (i.e., users
who require access to the system to satisfy mission, business, or operational requirements) and
for ensuring compliance with security requirements. In coordination with the system security
and privacy officers, the system owner is responsible for the development and maintenance of
the security and privacy plans and ensures that the system is operated in accordance with the
selected and implemented controls.
In coordination with the information owner/steward, the system owner decides who has access
to the system (and with what types of privileges or access rights).122 The system owner ensures
that system users and support personnel receive the requisite security and privacy training.
Based on guidance from the authorizing official, the system owner informs organizational
officials of the need to conduct the authorization, ensures that resources are available for the
effort, and provides the required system access, information, and documentation to control
assessors. The system owner receives the security and privacy assessment results from the
control assessors. After taking appropriate steps to reduce or eliminate vulnerabilities or
security and privacy risks, the system owner assembles the authorization package and submits
the package to the authorizing official or the authorizing official designated representative for
adjudication.123
121 Organizations may refer to system owners as program managers or business/asset owners.
122 The responsibility for deciding who has access to specific information within an organizational system (and with
what types of privileges or access rights) may reside with the information owner/steward.
123 The authorizing official may choose to designate an individual other than the system owner to compile and
assemble the information for the authorization package. In this situation, the designated individual coordinates the
compilation and assembly activities with the system owner.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SYSTEM SECURITY OR PRIVACY OFFICER

SYSTEM SECURITY OR PRIVACY OFFICER

The system security or privacy officer124 is an individual responsible for ensuring that the security
and privacy posture is maintained for an organizational system and works in close collaboration
with the system owner. The system security or privacy officer also serves as a principal advisor
on all matters, technical and otherwise, involving the controls for the system. The system
security or privacy officer has the knowledge and expertise to manage the security or privacy
aspects of an organizational system and, in many organizations, is assigned responsibility for the
day-to-day system security or privacy operations. This responsibility may also include, but is not
limited to, physical and environmental protection; personnel security; incident handling; and
security and privacy training and awareness.
The system security or privacy officer may be called on to assist in the development of the
system-level security and privacy policies and procedures and to ensure compliance with those
policies and procedures. In close coordination with the system owner, the system security or
privacy officer often plays an active role in the monitoring of a system and its environment of
operation to include developing and updating security and privacy plans, managing and
controlling changes to the system, and assessing the security or privacy impact of those
changes.
When the system security officer and system privacy officer are separate roles, the system
security officer is generally responsible for aspects of the system that protect information and
information systems from unauthorized system activity or behavior to provide confidentiality,
integrity, and availability. The system privacy officer is responsible for aspects of the system that
ensure compliance with privacy requirements and manage the privacy risks to individuals
associated with the processing of PII. The responsibilities of system security officers and system
privacy officers overlap regarding aspects of the system that protect the security of PII.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SYSTEM USER

SYSTEM USER

The system user is an individual or (system) process acting on behalf of an individual that is
authorized to access information and information systems to perform assigned duties. System
user responsibilities include, but are not limited to, adhering to organizational policies that
govern acceptable use of organizational systems; using the organization-provided information
technology resources for defined purposes only; and reporting anomalous or suspicious system
behavior.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > SYSTEMS SECURITY OR PRIVACY ENGINEER

SYSTEMS SECURITY OR PRIVACY ENGINEER

The systems security or privacy engineer is an individual, group, or organization responsible for
conducting systems security or privacy engineering activities as part of the SDLC. Systems
security and privacy engineering is a process that captures and refines security and privacy
requirements for systems and ensures that the requirements are effectively integrated into
124 Organizations may define a system security manager or security manager role with similar responsibilities as a
system security officer or with oversight responsibilities for a security program. In these situations, system security
officers may, at the discretion of the organization, report directly to system security managers or security managers.
Organizations may assign equivalent responsibilities for privacy to separate individuals with appropriate subject
matter expertise.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX G > Task C-2). However, separately categorizing each subsystem does not change the overall

Task C-2). However, separately categorizing each subsystem does not change the overall

categorization of the system. Rather, separately categorizing each subsystem allows the
subsystems to receive a separate and more targeted allocation of controls from [SP 800-53]
instead of deploying higher-impact controls across the entire system (see Task P-17 and Task S-
3). Another approach is to bundle smaller subsystems into larger subsystems within the system,
categorize each of the aggregated subsystems, and allocate controls to the subsystems, as
needed. While subsystems within complex systems may exist as complete systems, the
subsystems are, in most cases, not treated as independent entities because they are typically
interdependent and interconnected.
When the security categorizations for the identified subsystems are different (e.g., low-impact
versus high-impact), the organization examines the subsystem interfaces,164 information flows,
and security and privacy dependencies among subsystems and selects the appropriate controls
164 The types of interfaces and couplings among subsystems may introduce inadvertent vulnerabilities in a complex
system. For example, if a large organizational intranet is decomposed into smaller subsystems (e.g., severable
systems such as local area network segments) and subsequently categorized individually, the specific protections at
the system level may expose an attack vector against the intranet by erroneously selecting and implementing controls
that are not sufficiently strong with respect to the rest of the system. To avoid this situation, organizations carefully
examine the interfaces among subsystems and take appropriate actions to eliminate potential vulnerabilities in this
area, thus helping to ensure that the information system is adequately protected.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > TASK DELEGATION

TASK DELEGATION

The roles specified in the Primary Responsibility section for each RMF task are responsible for
ensuring that the task is completed. The roles with primary responsibility may complete a task
or may delegate completion of a task to one or more supporting roles except where delegation
is specifically prohibited or disallowed in the task Discussion section or Appendix D. If completion
of a task is delegated, the role with primary responsibility for that task remains accountable for
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > Task M-3 Respond to risk based on the results of ongoing monitoring activities, risk assessments, and

Task M-3 Respond to risk based on the results of ongoing monitoring activities, risk assessments, and

outstanding items in plans of action and milestones.
107 In accordance with [OMB A-130], an independent evaluation of privacy programs and practices is not required.
However, an organization may choose to employ independent privacy assessments at the organization's discretion.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > Task M-4 Update plans, assessment reports, and plans of action and milestones based on the results of

Task M-4 Update plans, assessment reports, and plans of action and milestones based on the results of

the continuous monitoring process.
Potential Inputs: Security and privacy assessment reports; organization- and system-level risk assessment
results; security and privacy plans; plans of action and milestones.
Expected Outputs: Updated security and privacy assessment reports;108 updated plans of action and
milestones; updated risk assessment results; updated security and privacy plans.
Primary Responsibility: System Owner; Common Control Provider.
Supporting Roles: Information Owner or Steward; System Security Officer; System Privacy Officer; Senior
Agency Official for Privacy; Senior Agency Information Security Officer.
System Development Life Cycle Phase: New - Operations/Maintenance.
Existing - Operations/Maintenance.
108 If a comparable report meets the requirements of what is to be included in an assessment report (e.g., a report
generated from a security or privacy management and reporting tool), then the comparable report would constitute
the assessment report.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > Task M-5 Report the security and privacy posture of the system to the authorizing official and other

Task M-5 Report the security and privacy posture of the system to the authorizing official and other

organizational officials on an ongoing basis in accordance with the organizational continuous
monitoring strategy.
Potential Inputs: Security and privacy assessment reports; plans of action and milestones; organization-
and system-level risk assessment results; organization- and system-level continuous monitoring strategy;
security and privacy plans; Cybersecurity Framework Profile.
Expected Outputs: Security and privacy posture reports.109
Primary Responsibility: System Owner; Common Control Provider; Senior Agency Information Security
Officer; Senior Agency Official for Privacy.
Supporting Roles: System Security Officer; System Privacy Officer.
System Development Life Cycle Phase: New - Operations/Maintenance.
Existing - Operations/Maintenance.
109 If a comparable report meets the requirements of what is to be included in a security or privacy posture report
(e.g., a report generated from a security or privacy management and reporting tool), then the comparable report
would constitute the posture report.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > Task M-6 Review the security and privacy posture of the system on an ongoing basis to determine

Task M-6 Review the security and privacy posture of the system on an ongoing basis to determine

whether the risk remains acceptable.
Potential Inputs: Risk tolerance; security and privacy posture reports; plans of action and milestones;
organization- and system-level risk assessment results; security and privacy plans.
Expected Outputs: A determination of risk; ongoing authorization to operate, ongoing authorization to
use, ongoing common control authorization; denial of ongoing authorization to operate, denial of ongoing
authorization to use, denial of ongoing common control authorization.
110 See Appendix F for additional information about time- and event-driven authorizations and reporting.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > Task M-7 Implement a system disposal strategy and execute required actions when a system is removed

Task M-7 Implement a system disposal strategy and execute required actions when a system is removed

from operation.
Potential Inputs: Security and privacy plans; organization- and system-level risk assessment results;
system component inventory.
Expected Outputs: Disposal strategy; updated system component inventory; updated security and
privacy plans.
Primary Responsibility: System Owner.
Supporting Roles: Authorizing Official or Authorizing Official Designated Representative; Information
Owner or Steward; System Security Officer; System Privacy Officer; Senior Accountable Official for Risk
111 See Appendix F for additional information on ongoing authorization and continuous monitoring.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE > Task S-2). Organizations do not need to choose one approach for the selection of controls for each of their

Task S-2). Organizations do not need to choose one approach for the selection of controls for each of their

systems, but instead, may use different approaches as circumstances dictate.
References: [FIPS 199]; [FIPS 200]; [SP 800-30]; [SP 800-53]; [SP 800-53B]; [SP 800-160 v1] (System
Requirements Definition, Architecture Definition, and Design Definition Processes); [SP 800-161] (Respond
and Chapter 3); [IR 8062]; [IR 8179]; [CNSSI 1253]; [NIST CSF] (Core [Identify, Protect, Detect, Respond,
Recover Functions]; Profiles).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > THE FUNDAMENTALS

THE FUNDAMENTALS

HOW TO MANAGE SECURITY AND PRIVACY RISK
his chapter describes the basic concepts associated with managing information system-
related security and privacy risk in organizations. These concepts include the RMF steps
and task structure; information security and privacy programs in the RMF; information
system, system elements, and how authorization boundaries are established; security and
privacy posture; and security and privacy risk management practices associated with the supply
chain.