The seven steps in the NIST RMF are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor Security Controls. The organization gets ready to manage its security and privacy risks by: Assessing organization-wide risk.