-: In this section of the course, 2 2
we're going to go into more depth into our coverage 3 3
of the seven steps of the risk management framework. 4 4
As we move through this section, 5 5
Jason and I will be dividing each step 6 6
into two distinct types of lessons 7 7
with my lessons being focused more 8 8
on the textbook description of how RMF 9 9
is performed during each step 10 10
including the associated tasks. 11 11
And Jason's lesson will be focused more 12 12
on the real world application of each step 13 13
including the pitfalls and the landmines 14 14
and all the common trouble areas experienced 15 15
by practitioners in the field who are using RMF, 16 16
like you will be. 17 17
So as we move through this section, 18 18
you'll notice ,we'll go step by step 19 19
through the RMF process, 20 20
starting with the standard definitions 21 21
and then exploring the real world implications of using RMF. 22 22
First, we'll explore step one, which is called Prepare. 23 23
During the Prepare step, you and your organization 24 24
will perform essential activities to get the organization 25 25
and your system ready to manage security, privacy, 26 26
and supply chain risks. 27 27
Second, we'll explore step two, Categorize. 28 28
During the Categorize step, guess what? 29 29
You'll categorize the system 30 30
and the information that it processes, 31 31
stores, and transmits based on an impact analysis. 32 32
Then, we'll explore step three, which is called Select. 33 33
During the Select step, you'll select the set 34 34
of NIST special publication 800 dash 53 controls 35 35
that you'll need to protect the system 36 36
based on your risk assessments. 37 37
Then, we'll explore step number four, 38 38
which is called Implement. 39 39
And during the Implement step, 40 40
you'll actually put the controls that you selected 41 41
in step three into the system, 42 42
and you'll document how those controls are deployed. 43 43
And then, we'll go into step number five, 44 44
which is called Assess. 45 45
During the Assess step, 46 46
you'll assess the controls that you deployed in step four, 47 47
and you're going to determine 48 48
if the controls are in place, operating as intended, 49 49
and producing the desired results. 50 50
Now, in step six, which is called Authorize, 51 51
we're going to take a deep dive look 52 52
at what you need to do to set a senior official up 53 53
to be able to make a risk-based decision 54 54
to either authorize the system 55 55
to operate on your organization's network, 56 56
or to determine what kind of rework will be necessary 57 57
so that they can give you that approval. 58 58
And finally, we'll take a look 59 59
at step number seven, which is called Monitor. 60 60
And during the Monitor step, 61 61
you'll continuously monitor your control implementations 62 62
and the risks to your systems. 63 63
So if you're ready, let's jump into our in-depth coverage 64 64
of the seven steps of the risk management framework 65 65
in this section of the course.