The National Institute of Standards and Technology issues a process called the Risk Management Framework (RMF). It’s designed to integrate “security, privacy, and cyber supply chain risk management activities into the system development life cycle.” Risk assessment and risk management are critical to the foundation and success of organizations, particularly when it comes to cybersecurity. The NIST Risk Management Framework takes into consideration many disparate factors to present a cohesive set of recommendations and guidelines.
NIST Risk Management Framework: The 7 RMF Steps
The Risk Management Framework has seven steps, which we’ll break down and summarize for you here:
Step 1: Prepare
Organizations can use the NIST Risk Management Framework to assess and prepare for security risks and look at improving their protection, particularly their data and networks. If legacy security methods and systems are still in use, it’s imperative to prepare for necessary upgrades and defend against vulnerabilities.
Step 2: Categorize
The second step in the RMF is to categorize system processes and characteristics and then determine what the impact would be if the worst-case scenario happened. What would happen to organizational information, records, and systems if a security breach did occur? What are the risks to production, reputation, finances, and liability?
Step 3: Select
The next RMF step is to select, customize, and document the measures necessary to ensure adequate security and mitigate risks. It’s not enough to think about today or tomorrow – to set the bar at the bare minimum.
How can you better prepare and protect for the future? Sometimes, as is the case with the quantum revolution, technological advances can happen much faster than theorized. So, what can you do to mitigate all identified risks for as long as possible?
Step 4: Implement
RMF step four is probably fairly evident, but once you’ve determined the appropriate methods, tools, and platforms to better protect your organization, they must be implemented. After you implement your security measures, document them to prepare for the following RMS steps.
Step 5: Assess
After implementation, the next step is to monitor the next security measures and make sure they are operating as expected and producing the desired effect.
Especially when it comes to protecting valuable data and networks, it’s not enough to set it and forget it. Organizations must keep their eyes on the ball, and make sure that their processes and controls are doing the job they’re meant to do.
Step 6: Authorize
This next-to-last RMF step adds accountability. It calls for senior leadership to oversee the plan, the implementation, and the assessment and decide if it all adequately responds to the risk. What is the new security risk assessment? If there are any remaining vulnerabilities or risks, are they acceptable?
Step 7: Monitor
The seventh and final step of NIST’s Risk Management Framework is to maintain awareness of the organization’s security controls and threats and determine if current methods are still working and will continue working in the future. Assessment and reporting processes should be put in place to ensure that this is consistently managed.
NIST Cybersecurity Framework
The NIST Cybersecurity Framework (CSF) is a set of specific guidelines designed to adapt and evolve to changing technologies and threats. It intends to determine “best practice” and see them adopted as “common practice”.
In 2014, the Cybersecurity Enhancement Act (CEA) “updated the role of the National Institute of Standards and Technology (NIST) to include identifying and developing cybersecurity risk frameworks for voluntary use by critical infrastructure owners and operators.” The NIST was charged with developing a comprehensive set of guidelines that included “information security measures and controls that may be voluntarily adopted by owners and operators of critical infrastructure to help them identify, assess, and manage cyber risks.”
2023 is a year of assessment, stakeholder input, and updates. By 2024, NIST will release Cybersecurity Framework 2.0. The current one in place is version 1.1 and its five main functions:
- Identify: Form a fundamental understanding of the organization and the “cybersecurity risks to systems, people, assets, data, and capabilities”.
- Protect: Develop strategies to protect against these risks and implement robust cyber security measures that include policies and procedures, technology and controls, awareness and training, and more.
- Detect: Determine how to pinpoint a cyber attack, and set up secure monitoring to mitigate the impact of these events.
- Respond: If a cyber attack occurs, organizations should have comprehensive procedures in place to adequately deal with it, stop it, and mitigate risk. In addition, steps to improve security as necessary should also be established.
- Recover: Institute plans to develop and maintain cybersecurity resilience and to recover as quickly as possible from any future cyber attacks.
Risk management is vital to the health and success of any organization, but even more so for critical infrastructure, defense, and military institutions. MAG has technology and solutions in place that support the implementation of RMF and CSF guidelines into procedures, operations, and security architecture.
How MAG Adapts RMF Guidelines Into Our Cyber Security Solutions
We have several resilient, agile, and innovative solutions for defense against cyber security threats.
Near-Peer/Contested Environments
MAG can take technology that is available in the commercial sector and enable it to support the contested domain.
By developing and implementing sensors and systems designed for the new environments, we provide seamless coordination and operations across the battle theater. Our data and software processing is designed to mitigate the impact of any particular site or hardware failure, which further empowers agile use in combat.
Information Assurance Engineering
This dynamic cybersecurity capability encompasses multiple disciplines, including:
- Security architecture engineering
- Security assessment and authorization (A&A) support
- System vulnerability identification and remediation
- Security artifact and supporting document production
- Information Assurance Vulnerability Management (IAVM)
- Penetration testing and ethical hacking
- Federal Information System Management Act (FISMA) compliance
Resilient Communications
Our communications engineering encompasses multiple security disciplines, including:
- Security architecture engineering
- Security assessment and authorization (A&A) support
- System vulnerability identification and remediation
- Security artifact and supporting document production
- Information Assurance Vulnerability Management (IAVM)
- Penetration testing and ethical hacking
- Federal Information System Management Act (FISMA) compliance
DevSecOps
DevSecOps is a forward-thinking strategy for integrating security into development from the start of any project. MAG security teams work in tandem with development and operations teams throughout the software delivery cycle.
We look for security vulnerabilities and conduct early threat modeling, security design reviews, static code analysis, and code reviews throughout the development process. We also automate the security gates and select the right tools to continuously integrate security.
Cross Domain Solutions
Our security engineers have executed cross domain solutions (CDS) for US government clients, including Army sites and the Army Cross Domain Solutions Office (CDSO). We’ve helped ensure policies and procedures are followed and that requirements for fielding Defense Information Infrastructure (DII) Guards are met.
Joint All-Domain Command and Control (JADC2)
We enable the secure connection and interoperability of sensors in a unified network across multiple services and domains.
We can take data from different environments, process it using AI algorithms, and identify items of interest. This empowers better and faster decision-making by providing actionable recommendations.
FISMA & IAVM Compliance
We make sure that our customer’s information systems maintain a post-deployed security posture and maintain FISMA compliance. We participate in the preparation and execution of the FISMA Security Controls Review to ensure DoD and federal information systems comply with FISMA requirements.
Part of this process includes evaluating the validity and effectiveness of key security controls, analyzing disaster recovery and continuity of operations, and reviewing policy and process incident response planning as well as production code changes to determine IA impacts, current IAVM policies and management, and periodic integrity testing.
NIST RMF Support
MAG specifically helps our clients meet NIST’s Risk Management Framework guidelines with:
- Proactive expertise in the advancement of DoD cybersecurity risk management
- System categorization support that will determine adverse impact, including losses or the compromise of confidentiality, integrity, or availability of a system or its information (Step 2)
- Analysis, identification, and assignment of NIST Special Publications 800-53 security controls, applicable overlays, and federal security standards (Step 3)
- Development of RMF artifacts and supporting documentation in support of authorization (Step 6)
- Systems and Network Vulnerability Assessment (NVA) scanning
- Vulnerability identification, documentation, and remediation tracking in accordance with the IAVM process
- Formal Security Control Assessment (SCA) test support
Security Assessments and Remediation
In keeping with NIST’s Assess and Monitor steps, we run automated scan tools against networks, operating systems, and compatible applications. We also conduct additional manual assessments as necessary, using approved DoD and Army solutions:
- Assured Compliance Assessment Solution (ACAS), using the Nessus vulnerability scanner
- Security Content Application Protocol (SCAP) Compliance Checker (SCC) with STIG benchmark content
With the risk of new, increasingly dynamic threats, including the advent of quantum computing, it’s important to have agile and powerful security in place to defend systems, assets, infrastructure, and people against them.
With MAG’s expert engineering and technology services and our comprehensive cybersecurity solutions, we can develop and implement strong, next-generation defenses for our clients, aligning them with the NIST Risk Management Framework and the future of security.
Learn more or connect with us today.
