The NIST Risk Management Framework in 7 Steps

The Risk Management Framework (RMF), defined in NIST SP 800-37, is how U.S. federal systems are secured, authorized, and kept safe over time. It exists because FISMA requires agencies to manage information-system risk on a continuous basis, not as a one-time checkbox. RMF turns that legal requirement into a repeatable lifecycle that produces a defensible, risk-based decision to operate a system.

The whole framework drives toward one moment: a senior official, the Authorizing Official (AO), looking at the evidence and accepting the residual risk by granting an Authorization to Operate (ATO).

• 1. Prepare: establish context, roles, and a risk strategy before anything else. Identify the system, its mission, and the people accountable.
• 2. Categorize: rate the impact (Low / Moderate / High) on Confidentiality, Integrity, Availability using FIPS 199. The overall category is the *high-water mark*. This step drives everything downstream.
• 3. Select: choose and tailor the control baseline from NIST SP 800-53 that matches the categorization.
• 4. Implement: put the controls in place and document *how* each is implemented in the System Security Plan (SSP).
• 5. Assess: an independent assessor tests whether the controls actually work, documenting results in the Security Assessment Report (SAR).
• 6. Authorize: the AO weighs the SAR and POA&M and makes the risk-based decision: the ATO.
• 7. Monitor: continuously assess controls, watch for new weaknesses, and report the system's security state. RMF is a cycle, not a finish line.

Three documents do most of the heavy lifting, and an interviewer expects you to know them cold:

• SSP: the system's security story on paper: boundary, environment, and how every control is implemented.
• SAR: the independent assessor's findings on whether controls are effective.
• POA&M (Plan of Action & Milestones): the living list of known weaknesses with an owner and an estimated completion date (ECD) for each.

Most systems already hold an ATO, which means most ISSO work happens in Step 7: Continuous Monitoring: reviewing scan and pen-test findings, keeping the configuration baseline signed, confirming interconnection agreements (ISAs) haven't lapsed, and keeping the SSP and POA&M honest. If you can speak to ConMon as a monthly rhythm of work, you sound like someone who has done the job.