The National Institute of Standards and Technology announced the final public draft of Special Publication 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations--A System Life Cycle Approach for Security and Privacy.
The new draft provides guidelines for applying Risk Management Framework rigor to information systems and organizations. The RMF provides a disciplined, structured and adaptable process for managing security and privacy risk that includes information system categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring, NIST said in the release.
The RMF provides guidance to prepare organizations to execute the framework at appropriate risk management levels. The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions; and incorporates security and privacy into the system development life cycle.
Implementing RMF tasks links crucial risk management processes at the system level to risk management processes at the organizational level. Further, it establishes responsibility and accountability for the controls implemented within an organization’s information systems.
NIST summarized seven major objectives for this update:
-- Provide closer linkage and communication between the risk management processes and activities at the C-suite or governance level of the organization and the individuals, processes, and activities at the system and operational level of the organization;
-- Institutionalize critical risk management preparatory activities at all risk management levels to facilitate a more effective, efficient and cost-effective execution of the RMF;
-- Demonstrate how the NIST Cybersecurity Framework can be aligned with the RMF and implemented using established NIST risk management processes;
-- Integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible;
-- Promote the development of trustworthy secure software and systems by aligning life cycle-based systems engineering processes in NIST Special Publication 800-160, Volume 1, with the relevant tasks in the RMF;
-- Integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC; and
-- Allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST Special Publication 800-53, Revision 5.
The addition of the preparation step is one of the key changes to the RMF which is integral to achieve more effective, efficient and cost-effective security and privacy risk management processes, according to NIST.
In addition to seeking comments on this final public draft, NIST is specifically asking for feedback on a new RMF Task P-13, Information Life Cycle. The life cycle describes the stages through which information passes, typically characterized as creation or collection, processing, dissemination, use, storage, and disposition, which includes destruction and deletion.
Identifying and understanding all stages of the information life cycle have significant implications for security and privacy. NIST seeks comment on how organizations would execute this task and how it could facilitate the most helpful discussion to assist organizations in the implementation.
Special Publication 800-37, Revision 2 was written by a Joint Task Force.
The public comment period for this draft document is open until Oct. 31, 2018. Please submit comments using the available comment template to email@example.com.
NIST Planning Note (10/2/2018): See the current publishing schedule.