There is a draft update to the Risk Management Framework (RMF) that can help organizations more easily protect the nation’s critical assets from cybersecurity threats as well as protect individuals’ privacy meet these goals.
The RMF update, created by the National Institute of Standards and Technology (NIST), formally entitled “Draft NIST Special Publication (SP) 800-37 Revision 2”, is a guidance document designed to help organizations assess and manage risks to their information and systems.
Previous versions of the RMF were primarily concerned with cybersecurity protections from external threats. The updated version adds an overarching concern for individuals’ privacy, helping to ensure organizations can better identify and respond to these risks, including those associated with using individuals’ personally identifiable information.
The update will interest federal agencies and contractors that do business with them, as it connects the RMF with NIST’s Cybersecurity Framework (CSF), highlighting relationships that exist between the two documents.
“Until now, federal agencies had been using the RMF and CSF separately,” said NIST’s Ron Ross, one of the publication’s authors. “The update provides cross-references so that organizations using the RMF can see where and how the CSF aligns with the current steps in the RMF. Conversely, if you’re using the CSF, you can bring in the RMF and give your organization a robust methodology to manage security and privacy risks.”
In addition to the RMF-CSF alignment, the update has several important objectives, including:
• Integrating security and privacy into systems development. Building security and privacy into information systems at the initial design stage is a major concern. The RMF also references NIST systems security engineering guidance at appropriate points, including NIST’s SP 800-160, which addresses the engineering of trustworthy secure systems.
• Connecting senior leaders to operations. The RMF provides guidance on how an organization’s senior leaders can better prepare for RMF execution, as well as how to communicate their protection plans and risk management strategies to system implementers and operators.
• Incorporating supply chain risk management considerations. The RMF addresses growing supply chain concerns in the areas of counterfeit components, tampering, theft, insertion of malicious software and hardware, poor manufacturing and development practices, and other potential harmful activities that can impact an organization’s systems and systems components.
• Supporting security and privacy safeguards. The RMF update will provide organizations with a disciplined and structured process to select controls from the newly developed consolidated security and privacy control catalog in NIST’s SP 800-53, Revision 5.
“It was imperative for us to figure out how these frameworks fit together,” Ross said. “Many agencies are trying to follow both.”
Ross added the privacy-enhanced RMF might be valuable to companies and organizations beyond the federal government, considering how high profile the subject of privacy has become of late.
“Many folks are discovering how vulnerable they are with respect to their personal information and may begin to demand some standard level of protection,” he said. “If such a demand occurs, the government will be looking for clearly stated requirements for privacy, privacy safeguards, and a disciplined and structured process on how those controls could be applied. The timing of this publication could not be any better.”
NIST is accepting comments from the public on the draft RMF until June 22, 2018. A final version will come out in October 2018.