Standards and frameworks · Governance and coordination

NIST SP 800-37 Rev. 2 (RMF) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

PublishedFree · December 2018

Summary

It describes the process by which an organisation manages the security and privacy risks of its systems throughout their life cycle. The seven steps are: prepare, categorise the system, select controls, implement them, assess them, authorise the system to operate and monitor it over time. It is the mandatory process for US federal agency systems and uses the SP 800-53 control catalogue, but any organisation can adopt it. It connects the organisation, mission and business process, and system levels.

Reference

NIST SP 800-37 Rev. 2 (RMF)

Official title

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

Body

NIST

Type

Cybersecurity framework

Status

Published

Published

December 2018

Edition

Rev. 2

Access to the text

Free

Sectors

• Governance and coordination
• Digital public administration

Notes

Revision 2 (December 2018) supersedes Revision 1 of 2014, adds the “prepare” step, integrates privacy and supply chain risk management, and links the process to the Cybersecurity Framework.

Last verified

2 November 2026 (verified via web)

Metadata and summary: CC BY 4.0 · JSON

Report an error in this record (opens in a new tab)