NIST SP 800-37 RMF

Risk Management Framework - categorize, select, implement, assess, authorize, monitor system controls.


Short name	RMF
Region	Americas
Country or scope	United States
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers RMF

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for RMF.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for RMF and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`RMF-CAT-DESC` System Description and Categorization	The Categorize step requires documenting the characteristics of the system, including its components and boundary, before impact levels can be assigned: presupposing an enumerated inventory of the software composing the system (SP 800-37r2, Categorize step system-description task)	Scan
`RMF-PREP-BOUND` Authorization Boundary and Asset Identification	The Prepare step at system level requires identifying the system's assets and determining its authorization boundary, which requires the constituent components to be individually identifiable (SP 800-37r2, Prepare step asset-identification and boundary tasks)	Scan
`RMF-IMPL-DOC` Documented Control Implementation	The Implement step requires documenting how controls are implemented in the system's security and privacy plans, supported by formally identified, timestamped machine-readable system documentation (SP 800-37r2, Implement step documentation task)	Scan
`RMF-ASSESS-INTG` Assessable System Integrity	The Assess step requires determining whether controls are implemented correctly and operating as intended; assessing software integrity controls requires verifiable integrity evidence such as component hashes (SP 800-37r2, Assess step)	Scan
`RMF-MON-CHANGE` Continuous Monitoring of System Changes	The Monitor step requires ongoing detection and analysis of changes to the system and its environment of operation; detecting component-level change requires known versions for the software in use (SP 800-37r2, Monitor step change-monitoring task)	Scan
`RMF-SCRM` Supply Chain Risk Management Integration	Revision 2 explicitly integrates supply chain risk management across the RMF steps, requiring organizations to understand and manage risk from the suppliers of system components (SP 800-37r2, SCRM integration)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`RMF-CA`	Categorize Information System
`RMF-CA-1`	Categorize: System Characterization
`RMF-SE`	Select Security Controls
`RMF-SE-1`	Select: Tailoring & Supplementation
`RMF-IM`	Implement Security Controls
`RMF-AS`	Assess Security Controls
`RMF-AS-1`	Assess: Security Assessment Report
`RMF-AS-2`	Assess: Plan of Action & Milestones
`RMF-AU`	Authorize Information System
`RMF-AU-1`	Authorize: Authorization Package
`RMF-MO`	Monitor Security Controls
`RMF-MO-1`	Monitor: Continuous Monitoring Strategy
`RMF-MO-2`	Monitor: Configuration Management

Policy templates

Written for RMF:

NIST RMF Authorization Package SOP

And 22 from the standard set, adapted to RMF.