Presenter: Some people wonder about the relationship 2 2
between RMF and the NIST cybersecurity framework. 3 3
There's all kinds of questions. 4 4
Are they the same? 5 5
Is one just a newer version of the other? 6 6
Maybe they're competing with each other 7 7
or are they mutually exclusive? 8 8
Maybe they cooperate somehow. 9 9
Well, first of all, they are different 10 10
so let's explore how they're different. 11 11
As we've seen, RMF is required 12 12
for federal government organizations 13 13
and it's hardly ever used in the private sector. 14 14
In contrast, the cybersecurity framework is voluntary 15 15
and it's aimed towards organizations 16 16
in critical infrastructure industries, 17 17
although it's useful and available to any member 18 18
of the private sector or the government sector. 19 19
Here's another difference. 20 20
RMF requires far more documentation 21 21
and is much more complicated 22 22
than the cybersecurity framework. 23 23
Because of this, 24 24
the cybersecurity framework is much more approachable 25 25
and easier to implement. 26 26
Furthermore, 27 27
implementing the RMF requires formal authorization 28 28
to operate or ATO 29 29
while the cybersecurity framework does not require 30 30
such government involvement in order to implement 31 31
and use it. 32 32
Here's another difference. 33 33
RMF is organized around the software development life cycle 34 34
while the cybersecurity framework is organized 35 35
around the life cycle of a security incident. 36 36
As you know by now, that means RMF has a seven step process 37 37
for building and monitoring secure systems. 38 38
You prepare to use RMF. 39 39
Next, you categorize the system 40 40
and the information related to it. 41 41
The third step is to select an initial set 42 42
of controls for the system. 43 43
The fourth step is to implement and document the controls. 44 44
Step number five is to assess the controls. 45 45
The sixth thing you do is you request authorization 46 46
to operate the system. 47 47
And then finally, step number seven is to monitor the system 48 48
and the controls on an ongoing basis. 49 49
In contrast, the cybersecurity framework consists 50 50
of five concurrent and continuous functions 51 51
that are meant to manage security incidents. 52 52
You identify risks and assets. 53 53
You protect those assets using controls and safeguards. 54 54
You detect incidents, you respond to incidents 55 55
and then you recover from any incidents. 56 56
The last thing I want to tell you is that CSF was created 57 57
by private industry through the facilitation of NIST 58 58
whereas RMF was created by the federal government itself. 59 59
In fact, RMF was developed 60 60
by the Joint Task Force, interagency working group. 61 61
That group includes representatives from the civil, 62 62
the defense, and the intelligence communities 63 63
and specifically the Department of Commerce and Defense, 64 64
the office of the Director of National Intelligence 65 65
and the Committee of National Security Systems. 66 66
As a result of all this, RMF has a much different look 67 67
and feel than CSF does. 68 68
Okay, 69 69
so now how can RMF 70 70
and the cybersecurity framework be used together? 71 71
Well, NIST has recommended 72 72
that you use CSF to strengthen RMF. 73 73
Specifically, there are elements 74 74
in the cybersecurity framework that can be used 75 75
to make RMF more robust and here's one example. 76 76
In step seven of RMF, you must conduct monitoring, 77 77
which as it turns out is what three 78 78
of the five CSF functions are great at, detect, respond, 79 79
and recover.