The NIST RMF Life Cycle

In this chapter, we dive into the nuanced journey of the NIST Risk Management Framework (RMF), a journey that is both cyclical and evolving. Unlike the foundational setup discussed in the previous chapter, this segment focuses on guiding you through the life cycle of the RMF, emphasizing the dynamic nature of risk management in the cyber world. Here, we will navigate through a detailed step-by-step breakdown of the RMF stages, not merely revisiting what was covered in Chapter 4 but expanding on it with a focus on real-world applicability and tailoring the framework to specific organizational needs.

In this chapter, we’re going to cover the following main topics:

• Step-by-step breakdown of the RMF stages
• Tailoring the RMF to your organization
• Case studies and examples

Step-by-step breakdown of the RMF stages

This section provides a breakdown of the RMF stages as a reminder of the details we covered in the previous chapter. Utilize this section as a guideline to refer back to as you work through tailoring the RMF to your organization, and learn about how other organizations have implemented the NIST RMF.

Here are the RMF stages:

• Prepare:
  • Scope definition: Establish the RMF’s scope across the organization. This includes what departments will participate in the process, as well as what infrastructure will be evaluated. In some cases, this may not be every network the organization utilizes based on segmentation.
  • Resource identification: Identify necessary resources, including personnel and technology. This can also include planning for the time to conduct the process as well as costs.
  • Risk assessment foundation: Develop a foundational understanding of risk assessment principles.
• Categorize:
  • System and information valuation: Evaluate...

Tailoring the RMF to your organization

Standards can be a useful template for your organization but they have to be tailored to fit correctly. The RMF is no exception. In this section, we’ll cover foundational ideas to keep in mind when working to tailor the RMF to your organization.

Understanding organizational context

Understanding your organization’s unique context is vital in effectively tailoring the RMF. This multifaceted process begins with a clear understanding of the organization’s mission and operational environment. Knowing the mission helps in aligning cybersecurity efforts with the organization’s primary objectives and services. The operational environment assessment includes the analysis of workflows, technology infrastructure, and the nature of data handled, which is crucial for identifying critical assets.

Understanding the regulatory landscape is another key aspect, as compliance requirements vary across industries. This involves...

Case studies and examples

Despite my best efforts, it’s not easy to locate organizations telling their story of implementing the NIST RMF. In fact, I was only able to locate one – the University of Florida. Our case study focuses on an implementation at the University of Florida. This was discussed at the NIST High-Performance Computing Workshop in 2018. The case study, titled Applying NIST Risk Management Framework to Controlled Unclassified Information on High-Performance Computing (HPC), focuses on the application of the NIST RMF to manage risks associated with controlled unclassified information (CUI) in a high-performance computing environment.

You can read about it here: https://www.nist.gov/system/files/documents/2018/03/28/erik_-_rmf-to-cui-for-hpc-lessons-deumens.pdf.

Here is a summary of the key points and the implementation process.

Background and context

Before we dive into the case study, we have to provide some context and background:

...

Summary

In this chapter, we refreshed ourselves on the stages of the NIST RMF, readying ourselves for our own implementation. We took it a step further beyond the foundational aspects covered previously, focusing on the dynamic nature of risk management in cybersecurity. We then examined a detailed case study of the University of Florida’s implementation of the NIST RMF in managing CUI. It outlined the background, collaborative efforts, technical implementation, and security goals of the project, providing a practical example of the RMF’s application in a specialized context.

Throughout the chapter, we placed an emphasis on understanding organizational context, stakeholder engagement, training, and the importance of documentation and communication in successfully implementing and adapting the RMF. This chapter aims to guide you in applying the RMF, no matter the organizational setting, ensuring that your own cybersecurity efforts will align with your organization&...