According to the Department of Defense (DoD) Instruction 8510.01, the Risk Management Framework (RMF) process for lifecycle cybersecurity risk to DoD systems is in accordance with NIST SP 800-30, 800-37, 800-39, 800-53A, 800-137, Committee on National Security Systems Policy No. 22, CNSSI No. 1253 and 1254, DoDD 8000.01, and DoDI 8500.01.
NIST SP 800-30 is used to conduct risk assessments within the parameters of the NIST framework to identify, estimate, and prioritize risks to the operation of organizations. The NIST RMF and supporting publications have been adopted throughout the Federal Government, by state and local governments, the private sector, and academia—nationally and internationally.