RMF Steps: The 7 Steps of the NIST Risk Management Framework Explained

The NIST Risk Management Framework (RMF) is the process US federal agencies use to manage the security and privacy risk of their information systems. It has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, set out in NIST Special Publication (SP) 800-37 Revision 2, published in December 2018. The steps lead to a senior official, the authorizing official, deciding whether to accept the system's remaining risk, usually by granting an authorization to operate (ATO). The system is then monitored for as long as it runs.

What are the 7 steps of the RMF?

Here are the seven RMF steps in order, with the question each one answers:

1. Prepare. Are the organization and the system ready to manage security and privacy risk?
2. Categorize. How bad would it be if the system's information were exposed, changed or lost?
3. Select. Which security and privacy controls does the system need?
4. Implement. Are those controls built, and is each one written down?
5. Assess. Do the controls work as intended?
6. Authorize. Is the remaining risk acceptable to the official who answers for it?
7. Monitor. Is the risk still acceptable as the system and its threats change?

Two terms recur below. A control is a safeguard, such as multi-factor sign-in or audit logging; most of them are security controls, and some protect privacy. The authorizing official (AO) is the senior official who decides whether the system may run.

What is the NIST Risk Management Framework?

The National Institute of Standards and Technology (NIST) developed the NIST RMF and describes it as a disciplined, structured and flexible process for managing security and privacy risk. Agencies use it for cybersecurity risk management and to meet their compliance duties under federal law. The law behind it is the Federal Information Security Modernization Act of 2014 (FISMA), which makes each agency responsible for protecting its information and systems. OMB Circular A-130, from the Office of Management and Budget, requires agencies to implement a risk management framework and points to the RMF described in NIST SP 800-37.

The RMF does not ask for the most security at any cost. It asks for enough protection, chosen on purpose, so the mission can run at a level of risk the organization accepts. NIST also lets each organization decide how to carry out each step and task, as long as it meets its requirements and manages the risk.

Revision 2 replaced Revision 1, the six-step version first published in 2010 and updated in 2014. NIST lists seven objectives for the update. Among them, it added the Prepare step, integrated privacy risk management, brought in supply chain risk management, and allowed an organization-generated way to select controls. As of October 2026, Revision 2 is the current final version.

Step 1: Prepare

Prepare gets the organization and the system ready before any controls are picked. NIST splits it into two levels.

At the organization level, the tasks include naming people to risk management roles, setting a risk management strategy that states the organization's risk tolerance, and running an organization-wide risk assessment. The organization also identifies common controls: controls that one team provides and many systems inherit, such as a data center's physical security. It writes a continuous monitoring strategy as well.

At the system level, the team states the mission the system supports, identifies stakeholders and assets, and draws the authorization boundary: the line around what the authorization will cover. It lists the information types the system handles and how that information moves through its life. It then registers the system with the right office.

In practice, weak preparation shows up later: a fuzzy boundary or a missing information type can cause trouble in every later step.

Lesson: Step 1, Prepare.

Step 2: Categorize

Categorize decides how much protection the system needs, based on the harm that a loss of its information would cause. A system that holds sensitive information, such as health or tax records, often rates higher. The team describes the system and then rates the impact of losing confidentiality (unauthorized disclosure), integrity (unauthorized change) or availability (loss of access).

Each information type is rated low, moderate or high for each of those three objectives, using FIPS 199, the Federal Information Processing Standard for security categorization. SP 800-60 helps map information types to ratings: Volume 1 gives the method and Volume 2 the suggested impact levels. FIPS 199 sets the system's category from the highest rating for each objective across its information types. FIPS 200 then sets the system's overall impact level as the highest of those three values, which it calls the high-water mark, and uses that level to choose the minimum security controls.

The authorizing official or a designated representative reviews and approves the categorization, with the senior agency official for privacy taking part when the system handles personal information. That result drives the control baseline in the next step.

Lesson: Step 2, Categorize.

Step 3: Select

Select chooses the controls that will protect the system. The team usually starts from a control baseline (a starting set of controls for low, moderate or high systems) in SP 800-53B that matches the impact level. NIST also allows an organization-generated selection instead. The controls themselves are defined in the catalog, SP 800-53 Revision 5.

Next comes tailoring: adjusting the baseline to fit the system. The team can remove controls that do not apply, add controls for specific threats, and fill in organization-defined values, such as how often to review accounts. Each control is then allocated to the system, to a common control provider, or to both. That split is called a hybrid control.

The team records the planned controls in the system security plan and, where personal information is involved, the privacy plan. It also writes the system's continuous monitoring strategy. The AO or a designated representative approves the plans.

Lesson: Step 3, Select.

Step 4: Implement

The Implement step puts the selected controls in place. Engineers configure settings, deploy tools and write procedures. The work follows the plans from the Select step.

The second task is just as important: update the plans with what was actually built. Real systems drift from plans. When a control is implemented differently than planned, the security and privacy plans must say so. Assessors will compare the plan to the live system in the next step, so an out-of-date plan can become a finding.

Lesson: Step 4, Implement.

Step 5: Assess

The Assess step checks whether the controls are implemented correctly, operating as intended and producing the desired outcome. The authorizing official, or a designated representative, picks a control assessor with the right level of independence. The assessor develops an assessment plan, which the AO or a designated representative approves, and then runs it using SP 800-53A, which lists three methods: examine, interview and test.

The results go into security and privacy assessment reports. The system team fixes what it can and the assessor may reassess those fixes. Weaknesses that remain go into a plan of action and milestones (POA&M): a list of each weakness, the planned fix and the due date.

Lesson: Step 5, Assess.

Step 6: Authorize

In Authorize, the authorizing official reviews the authorization package and decides whether the remaining risk is acceptable. The system owner assembles the authorization package: the security and privacy plans, the assessment reports, the plan of action and milestones, and an executive summary.

The decision is often an authorization to operate (ATO) or a denial. SP 800-37 also describes other decision types. An authorization to use lets an agency rely on another organization's authorization package for a system it wants to use. A common control authorization covers controls that many systems inherit. The AO then reports the decision and any significant weaknesses to the right officials.

NIST defines the AO as a senior official or executive with the authority to formally assume responsibility and accountability for operating the system.

Lesson: Step 6, Authorize.

Step 7: Monitor

Monitor, the final step, tracks the system and its controls after authorization, so the AO knows whether the risk is still acceptable. The team tracks changes to the system and its environment and assesses controls on an ongoing schedule. It responds to new risk, such as a new cyber threat, and updates the plans, reports and plan of action and milestones. It reports the security and privacy posture to the AO and other officials. SP 800-137 explains how to build this information security continuous monitoring program.

When monitoring is strong enough, the organization can move to ongoing authorization. The AO then keeps the authorization current from monitoring data, instead of re-authorizing the system from scratch on a fixed date. The last task in Monitor is system disposal, when the system is retired.

Lesson: Step 7, Monitor.

Do the RMF steps have to happen in order?

Mostly, but not strictly. A team running the RMF for the first time usually goes in order, because each step needs the outputs of the one before. You cannot pick a baseline before you know the impact level. But NIST says the steps after Prepare can be carried out in a nonsequential order. Teams may loop between tasks or revisit them, for example during agile development.

Monitor is also where the loop closes. NIST notes that changes in risk or in system functionality may mean revisiting one or more steps. A new data type, for example, can send the team back to Categorize or Select. Because of this loop, the RMF is often described as the RMF lifecycle: a cycle that runs for the life of the system.

Who does what in each RMF step?

Each step has its own lead roles. The system owner and the authorizing official appear throughout, and senior leaders carry most of the Prepare step.

SP 800-37 Appendix D sets out the full roles and responsibilities, and each task names its primary and supporting roles. NIST calls one role the system security officer; many agencies call it the information system security officer (ISSO). NIST notes that in many organizations this person is assigned the day-to-day security operations of the system, so the ISSO often keeps every step moving. Our role-based ISSO course follows that seat through the steps.

How does the RMF apply to DoD and its contractors?

The Department of Defense (DoD) uses the RMF for its own systems through DoD Instruction 8510.01. The March 2014 version of that instruction replaced DoD's older process, the DoD Information Assurance Certification and Accreditation Process (DIACAP), with the RMF through a phased transition; the current version dates from July 2022. A contractor that builds or runs a system for DoD will usually work inside that system's RMF process.

A contractor's own systems are a different case. When they hold Controlled Unclassified Information (CUI), contracts usually point to SP 800-171, not the full RMF. NIST withdrew Revision 2 in May 2024 in favor of Revision 3. The publisher does not decide which edition binds a contractor, though; the regulation does. The CMMC rule, 32 CFR 170.14, makes CMMC Level 2 identical to SP 800-171 Revision 2, and DoD contracts using DFARS 252.204-7012 still cite Revision 2. Check the contract and the regulation it cites to see which edition applies.

Key points about the RMF steps

• The Risk Management Framework (RMF) has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor (NIST SP 800-37 Rev. 2).
• Categorize uses FIPS 199 to rate impact as low, moderate or high.
• Select starts from an SP 800-53B baseline drawn from the SP 800-53 control catalog.
• Assess follows SP 800-53A, and open weaknesses go into a plan of action and milestones (POA&M).
• Authorize is a decision by the authorizing official (AO) to accept the risk, usually an authorization to operate (ATO).
• Monitor continues until the system is retired and disposed of.

How can you practice the RMF steps?

The free course NIST SP 800-37: The Risk Management Framework (RMF) walks each step with short lessons and checks. It begins with the seven steps and how each task is built. When you are ready, play a scenario: you choose among written responses at each decision point, face the assessor, and see what the AO decides.

Sources

• NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations
• NIST Risk Management Framework project, about the RMF
• Federal Information Security Modernization Act of 2014, Public Law 113-283
• OMB Circular A-130, Managing Information as a Strategic Resource
• FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
• FIPS 200, Minimum Security Requirements for Federal Information and Information Systems
• NIST SP 800-60 Vol. 1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories
• NIST SP 800-60 Vol. 2 Rev. 1, Appendices to the Guide for Mapping Types of Information
• NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-53B, Control Baselines for Information Systems and Organizations
• NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls
• NIST SP 800-137, Information Security Continuous Monitoring
• DoD Instruction 8510.01, Risk Management Framework for DoD Systems
• NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information (withdrawn May 2024; still cited by DoD contracts)
• 32 CFR 170.14, CMMC Model
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting