-: Cyber is a dynamic risk, 2 2
not a static one. 3 3
So we need to improve our risk management tools, 4 4
and methods on a regular basis. 5 5
And that's why the Risk Management Framework 6 6
has been updated several times 7 7
since it was first released in May 2004. 8 8
Revision one of RMF was published six years later 9 9
in February 2010, 10 10
and had minor updates made to it in June of 2014. 11 11
Right now, RMF is at version 2, 12 12
which was released in December 2018. 13 13
NIST has made many changes to RMF over the years. 14 14
Right now, I want to highlight some 15 15
of the most important changes in version 2. 16 16
A major goal of version 2 is to make RMF easier to complete 17 17
while giving better results at a reduced cost. 18 18
One way it does this is by adding the new prepare step 19 19
in order to better strategically integrate RMF 20 20
into both your organization level 21 21
and system-level activities. 22 22
The idea here is that the more you use RMF, 23 23
the better you're going to get. 24 24
Version 2 also better incorporates the missions 25 25
and business functions of the organization 26 26
that's attempting to get their system 27 27
and approval to operate, 28 28
which we often say as ATO. 29 29
Version 2 also tries to improve the communications 30 30
about RMF amongst senior leaders, 31 31
managers and operational personnel. 32 32
Other major updates to version 2 33 33
include the integration 34 34
of privacy risk management processes, and alignment 35 35
with the system development lifecycle 36 36
security engineering processes, 37 37
the incorporation of supply chain risk management processes, 38 38
and an alignment with the NIST cybersecurity framework. 39 39
This is noteworthy because the cybersecurity framework 40 40
makes a natural extension to RMF 41 41
because they're actually complementary to each other. 42 42
One way they're complementary 43 43
is that the cybersecurity framework 44 44
is organized around the five phases 45 45
of the incident lifecycle, 46 46
which are identify, protect, detect, respond and recover. 47 47
Now, this is very different than RMF, 48 48
which is organized around the systems development lifecycle. 49 49
And this means that the cybersecurity framework 50 50
could take a lot more to the table 51 51
when an RMF user reaches step seven, 52 52
which requires you to monitor your system 53 53
while it's supporting your mission. 54 54
A final thought on RMF version 2 55 55
is the increased emphasis on the use of automation. 56 56
NIST encourages RMF users to maximize the use 57 57
of automation wherever possible 58 58
to increase the speed, effectiveness 59 59
and efficiency of completing the seven steps 60 60
for each system. 61 61
NIST says that automation of RMF is particularly useful 62 62
in the preparation of authorization packages, 63 63
to speed decision making, 64 64
and in the assessment and continuous monitoring of controls. 65 65
Later in the course, we'll explore automation 66 66
in much greater detail.