NIST SP 800-37: the Risk Management Framework (RMF), explained

NIST SP 800-37, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," defines the Risk Management Framework (RMF) — NIST's own Risk Management project page calls it "a comprehensive, flexible, repeatable, and measurable 7-step process that any organization can use to manage information security and privacy risk." The current version, Revision 2, was published 20 December 2018, superseding Revision 1 (5 June 2014). RMF was built to support compliance with the US Federal Information Security Modernization Act (FISMA), but the step structure and the idea of integrating security, privacy and supply-chain risk into one life-cycle process are referenced well beyond federal agencies.

The seven steps

NIST's own About RMF page lays out the sequence:

Step	Purpose, per NIST
Prepare	"Essential activities to prepare the organization to manage security and privacy risks"
Categorize	"Categorize the system and information processed, stored, and transmitted based on an impact analysis"
Select	"Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)"
Implement	"Implement the controls and document how controls are deployed"
Assess	"Assess to determine if the controls are in place, operating as intended, and producing the desired results"
Authorize	A senior official "makes a risk-based decision to authorize the system (to operate)"
Monitor	"Continuously monitor control implementation and risks to the system"

Each step is further broken into numbered tasks in the full SP 800-37 Rev. 2 text — for example, NIST's dedicated Prepare-step page lists outcomes including risk management roles being identified, an organizational risk management strategy and risk tolerance being established, an organization-wide risk assessment, and a continuous-monitoring strategy. This guide describes the seven steps at that level; readers implementing RMF task-by-task should work from the primary SP 800-37 Rev. 2 document itself rather than a secondary summary, since this guide did not independently re-verify every individual task ID this run.

Prepare: the step Revision 2 added

Prepare did not exist in Revision 1. NIST's About RMF page for this step states its purpose is to "carry out essential activities to help prepare all levels of the organization to manage its security and privacy risks using the RMF," with outcomes spanning the organization, mission/business-process and system levels — not just a single system owner's checklist. Folding in a dedicated preparation step ahead of Categorize is one of the clearest structural differences between Rev. 1 and Rev. 2.

What changed in Revision 2 (2018)

NIST's news post announcing Revision 2 states it was developed in response to Executive Order 13800, "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure," along with related OMB circulars and memoranda. Beyond adding the Prepare step, NIST describes Rev. 2 as:

• The first NIST publication to integrate security and privacy risk management into one methodology, rather than treating privacy as a separate add-on process.
• Incorporating supply chain risk management (SCRM) concepts into the RMF, addressing risks like counterfeit components, tampering and malicious code insertion.
• Aligning more closely with the NIST Cybersecurity Framework and incorporating systems-engineering concepts from SP 800-160.

How RMF fits with SP 800-53, SP 800-30 and SP 800-39

RMF does not define its own control catalog or risk-assessment methodology from scratch — it calls on companion NIST publications at specific steps:

• SP 800-53 (our guide) supplies the control catalog: NIST's own description of the Select step is to "select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)."
• SP 800-39, "Managing Information Security Risk," establishes the organization/mission-business-process/system risk-management tiers that the Prepare step operationalizes at each level.
• SP 800-30 (our guide) is the detailed how-to for actually conducting a risk assessment — the activity that feeds both the Prepare step's organization-wide risk assessment and the risk-based control decisions made in Select.

Treated together, SP 800-39 sets the risk-management program, SP 800-30 tells you how to assess risk within it, SP 800-53 supplies the controls to select from, and SP 800-37 is the life-cycle process — Prepare through Monitor — that ties categorization, control selection, implementation, assessment, authorization and ongoing monitoring into one repeatable sequence.

A workable starting point

1. Don't skip Prepare. NIST added it specifically because organizations that jumped straight to Categorize without an established risk strategy, defined roles and identified common controls ended up rebuilding the same groundwork for every new system.
2. Treat Select as a two-input decision, not a static checklist: the SP 800-53 baseline plus the risk assessment from SP 800-30/800-39 together determine which controls actually apply.
3. Scope Monitor before you need it. The continuous-monitoring strategy is itself a Prepare-step outcome — deciding what "continuous" means for a given system is cheaper to do early than to retrofit after Authorize.
4. Treat privacy as integrated, not bolted on, per Rev. 2's own stated intent — privacy risk decisions should flow through the same seven steps as security risk decisions, not a parallel process.

SoftWSP helps device and firmware teams assemble the evidence (component inventories, known-vulnerability status, configuration state) that an RMF-style Categorize/Select/Assess cycle needs, without requiring a from-scratch federal compliance program: see device firmware security.

This guide summarises public NIST publications; it does not constitute legal or compliance advice.