-: Welcome to this course 2 2
on the NST Risk Management Framework, known as the RMF 3 3
In this course, you're going to learn all 4 4
about the NST Risk Management Framework 5 5
and how it's used to help integrate security, privacy 6 6
and cyber supply chain risk management activities 7 7
into the system development life cycle. 8 8
The Risk Management Framework was created by the 9 9
National Institute of Standards and Technology 10 10
known as NIST 11 11
to help provide a risk based approach to 12 12
control selection and help manage organizational risk 13 13
for large organizations across the globe. 14 14
RMF, unlike some other frameworks, 15 15
was designed to be applied to both newer systems 16 16
being fielded, 17 17
as well as older legacy systems 18 18
that still remain in use today across our organizations. 19 19
The Risk Management Framework can be applied 20 20
to any type of system or technology as well 21 21
whether it's an end users workstation, a web server 22 22
a database cluster, a cloud-based server environment, 23 23
a supervisory control and data acquisition system, 24 24
an internet of things device, 25 25
or really any other type of computing device or system. 26 26
-: RMF is also designed to be flexible and scalable 27 27
so you can use it with organizations both large and small. 28 28
Personally, I've used RMF in some small organizations 29 29
with only a few dozen employees 30 30
as well as inside of others 31 31
that had tens of thousands of employees 32 32
and it can be scaled upward and downward as needed 33 33
to provide the proper governance and risk management, 34 34
regardless of your organization's 35 35
size, scope, industry or sector. 36 36
Now, to help you get the most out of the framework 37 37
we're going to move through not just the theory 38 38
of how each of the seven steps 39 39
in the Risk Management Framework might be used 40 40
according to a textbook definition, 41 41
but we'll also dive into how each step is applied 42 42
in the real world 43 43
to make sure that you walk away from this course 44 44
with a good understanding of how 45 45
you can implement the Risk Management Framework inside 46 46
of your own organization. 47 47
-: First, we're going to begin 48 48
by introducing the Risk Management Framework 49 49
by providing an overview of RMF 50 50
and briefly looking at each of its seven steps 51 51
so that you can get a high level overview 52 52
of what RMF is and how it's going to be used. 53 53
Then we're going to move into some important details 54 54
concerning information security and privacy, 55 55
and how those are integrated together into RMF. 56 56
Also, we'll talk about authorization boundaries 57 57
for a given system and how they're going to be created. 58 58
We're also going to be discussing how supply chain 59 59
risk management is implemented inside 60 60
of the Risk Management Framework 61 61
so you can better understand that process as well. 62 62
Then we're going to be taking a look 63 63
at how flexible RMF can be 64 64
and we're going to discuss 65 65
the different requirements and controls 66 66
and the difference between these two concepts 67 67
because most people get these two vital areas confused 68 68
when they're trying to select and implement 69 69
various controls for their IT systems. 70 70
-: Next, we're going to look at each of the seven steps 71 71
of the Risk Management Framework in more depth 72 72
including how to prepare your organization 73 73
and your system for the RMF process 74 74
how to categorize your system, 75 75
how to select your controls, 76 76
how to implement those selected controls, 77 77
how to assess those same controls, 78 78
how to gain authorization to operate your system 79 79
and how to monitor the system over time 80 80
to ensure it's operating as expected. 81 81
As we dive into each step, 82 82
we'll cover not just the theory or details 83 83
from the Risk Management Framework documentation 84 84
but we'll also share our decades of experience with you 85 85
by pointing out the common pitfalls, 86 86
landmines and errors that people commonly make 87 87
when implementing RMF in the real world. 88 88
After that, we'll cover some other topics 89 89
that are important to understand when implementing RMF 90 90
including how you can automate RMF 91 91
an Introduction to eMASS, which is an acronym, and it stands 92 92
for the Enterprise Mission Assurance Support Service 93 93
which is software that's used to collect data for RMF 94 94
and helps you navigate the entire process 95 95
and we're going to tell you 96 96
how you can combine the Risk Management Framework 97 97
with the NIST Cybersecurity framework 98 98
which will call CSF, 99 99
to gain additional efficiencies. 100 100
We'll also teach you how you can use both of them 101 101
to increase the overall security of your systems. 102 102
-: So whether you're taking this course 103 103
to simply learn about the NIST Risk Management Framework 104 104
or you're taking this course 105 105
to learn how to implement the framework 106 106
inside of your organization, 107 107
this course has been designed specifically 108 108
to teach you the entire NIST Risk Management Framework 109 109
and how to apply it in the real world. 110 110
Before we dive into the course materials 111 111
let me provide you with a quick introduction 112 112
to the NIST Risk Management Framework. 113 113
After all, if your boss enrolled you in this course 114 114
you may not even know what 115 115
the NIST Risk Management Framework is 116 116
and what it's going to be used for. 117 117
-: The NIST Risk Management Framework helps organizations 118 118
implement a tried and true process 119 119
for the preparation, categorization, selection 120 120
implementation, assessment, authorization, and monitoring 121 121
of a given system and its associated security controls. 122 122
But I guess that begs the question, what is a framework? 123 123
Well, a framework 124 124
in the cybersecurity discipline 125 125
is a collection of best practices or guidelines 126 126
that an organization should follow 127 127
to manage its cybersecurity risk posture. 128 128
Most cybersecurity frameworks have the goal 129 129
of reducing the organization's exposure to cyber attacks 130 130
by identifying the areas that are most 131 131
at risk of being exploited by a threat actor. 132 132
-: The NIST Risk Management Framework is just 133 133
one cybersecurity framework available, 134 134
but it is by far one of the most popular and widely used. 135 135
Other competing frameworks include the 136 136
NIST Cybersecurity framework known as CSF, 137 137
the Center for Internet Securities 138 138
Critical Security Controls 139 139
known as CIS 140 140
and the International Standards Organization's frameworks 141 141
included inside the ISO/IEC 27001 and 27002. 142 142
For this course, though 143 143
we're going to be focused almost exclusively 144 144
on the NIST Risk Management Framework 145 145
in some of our discussions and planned implementations 146 146
but we're also going to spend a little bit of time 147 147
covering how you can integrate the Risk Management Framework 148 148
with the NIST Cybersecurity framework as well 149 149
because they do work very well together. 150 150
Now, hopefully you're excited 151 151
to begin learning all 152 152
about the NST Risk Management Framework, 153 153
but before we do we need to take a small detour 154 154
in this course to introduce you to your two instructors 155 155
and give you four important tips 156 156
to help you learn best during our time together. 157 157
My name is Jason Dion 158 158
and I am the lead instructor at Dion Training Solutions. 159 159
I've been working in the IT and cybersecurity field 160 160
for over two decades for organizations both large and small. 161 161
In all these organizations 162 162
though we were focused on trying to 163 163
identify, mitigate and manage cybersecurity risks 164 164
to keep threat actors at bay. 165 165
When I talk about small organizations 166 166
I'm talking about organizations like my own company 167 167
which has about 20 people 168 168
but I also have worked for large organizations too 169 169
and one of my last positions was 170 170
for an organization that spans six continents, 171 171
dozens of countries and millions of end users. 172 172
-: My name is Kip Boyle and I'm the founder 173 173
of Cyber Risk Opportunities, 174 174
where I serve as a chief information security officer 175 175
for many organizations across the United States 176 176
including a professional sports team, 177 177
some fast growing financial technology companies, 178 178
and a lot more. 179 179
Before that, I was a full-time CISO 180 180
for an insurance company, 181 181
and before that I helped design mitigations 182 182
for several Global 100 organizations 183 183
when I worked at Stanford Research. 184 184
My career in cybersecurity all started 185 185
when I was on active duty in the US Air Force, 186 186
where I led data protection programs 187 187
for several major weapons systems 188 188
like the F22 Stealth Fighter. 189 189
So as you can see, we aren't just instructors 190 190
we're practitioners in the cybersecurity industry 191 191
with lots of experience to share with you. 192 192
So I want you to rest assured you're in good hands with us. 193 193
-: Now for our four tips to success in this course. 194 194
First, for every video in this course 195 195
you have the ability to turn on closed captions. 196 196
Each video is captioned by a real human for accuracy 197 197
and this will allow you to read 198 198
along with the course if you need to. 199 199
Many of my students who speak English 200 200
as their second language 201 201
really love having those captions playing 202 202
along the bottom of the videos to aid in their learning. 203 203
If you want to enable the close captions, 204 204
simply click on the CC button 205 205
in the bottom of your video player. 206 206
-: The second tip is about playback speed. 207 207
Some of our students say Jason speaks too fast 208 208
and others have said, I speak way too slowly. 209 209
Either way, you can control the speed of instruction 210 210
by clicking on the 1X button 211 211
in the bottom of the video player. 212 212
Now, if you want me to teach faster 213 213
go ahead and choose 1.25X or even 1.5X 214 214
and if you'd like Jason to teach slower then 215 215
just click on the 0.75X or 0.5X. 216 216
Faster or slower, the choice is yours. 217 217
-: The third tip is that this course comes 218 218
with a downloadable study guide as a PDF 219 219
in lesson two of the course, 220 220
as well as a complete copy 221 221
of the NIST Risk Measurement Framework 222 222
as a PDF in lesson two. 223 223
I recommend that you download our study guide 224 224
and print it out 225 225
because it makes a great offline resource 226 226
as you begin working with the NIST Risk Management Framework 227 227
on a daily basis inside your organization. 228 228
-: The fourth tip is 229 229
that this course is just the beginning of your adventure 230 230
into the world of cybersecurity and risk management. 231 231
If you'd like to learn more 232 232
you can always visit yourcyber path.com 233 233
where we share our experience 234 234
through our free podcast and our paid membership programs. 235 235
If you have any questions for us, 236 236
you can always send us a video message at 237 237
yourcyberpath.com/ask 238 238
or you can post it in the Q and A of this course. 239 239
Now, with all the introductions behind us, 240 240
let's get started with learning 241 241
all about the NIST Risk Management Framework.