-: In this lesson, 2 2
I'm going to give you the big picture perspective 3 3
on the risk management framework. 4 4
If you're a big picture person like I am, 5 5
then I think you're going to appreciate this. 6 6
Every time you use RMF, 7 7
what you're trying to do is get to a point 8 8
where an authorizing official can decide 9 9
to either yes or no to this question. 10 10
Are we able to accept the residual risk of this system 11 11
when we connect it to the network 12 12
and use it to support our mission? 13 13
So I want you to remember 14 14
that RMF is not about achieving a 100% secure system. 15 15
It's also not about eliminating all risks. 16 16
Why? 17 17
Because there's just no practical way 18 18
to protect every digital asset 100% of the time 19 19
and still get real work done. 20 20
So you just want to get the overall risk 21 21
to the sensitive data and the critical system 22 22
down to a reasonable level, 23 23
where the residual risk is willing to be accepted 24 24
based on the benefits 25 25
you're going to get from using that system 26 26
to support your mission. 27 27
By the way, the term residual risk means 28 28
the risk that's left over in the system 29 29
after you've implemented the controls. 30 30
Now, I'm telling you all this, 31 31
because RMF is a very systematized approach 32 32
and when you're down in the weeds, 33 33
it can be easy to lose track of this big idea. 34 34
So again, 35 35
the big idea behind RMF 36 36
is to come up with the right amount of security 37 37
for your system 38 38
at the right time and at the right cost 39 39
with an acceptable amount of residual or leftover risk. 40 40
This is your North Star as you work through RMF 41 41
towards the approval to operate or the ATO 42 42
that you are aiming to get 43 43
from your authorizing official. 44 44
Now that means, 45 45
we need you to do some very good system security engineering 46 46
and RMF can help you do that. 47 47
It's important to realize that while you need to follow RMF, 48 48
I don't want you to put following the steps 49 49
at a higher priority 50 50
than delivering very good system security engineering. 51 51
By the way, the title of the publication 52 52
we're going to be learning about in this course 53 53
is Risk Management Framework 54 54
for Information Systems and Organizations, 55 55
A System Lifecycle Approach for Security and Privacy. 56 56
It's numeric designation 57 57
is NIST Special Publication 800-37, 58 58
and we are going to focus on Revision 2 in this course. 59 59
There are seven steps in the RMF process. 60 60
Let me quickly tell you what they are right now. 61 61
The first step is you have to prepare 62 62
your organization and your system 63 63
to manage security and privacy risk. 64 64
The second step is you have to categorize your system 65 65
and the information that it processes, stores, 66 66
and transmits. 67 67
The third step is you've got to get 68 68
into NIST Special Publication 800-53, 69 69
which is a catalog of controls, 70 70
and you have to select the ones 71 71
that are going to help you reduce risk. 72 72
Step number four is you implement the controls 73 73
and you document how they're deployed. 74 74
Step number five is you assess 75 75
to determine if the controls are in place 76 76
that they're operating as they're supposed to 77 77
and that you are getting the correct results from them. 78 78
Step number six is your senior official then is asked 79 79
to make a risk-based decision 80 80
to authorize the system to become a production system. 81 81
And then, the seventh step is to continuously monitor 82 82
the implementation of your controls and to make sure 83 83
that the risks to your system stay reasonable. 84 84
In the next lesson, 85 85
we're going to give you a little more detail 86 86
on the seven steps I just covered. 87 87
And later in the course, 88 88
we're going to take each step completely apart 89 89
and explain what you have to do 90 90
and how to do it in the real world.