Risk Management Framework (RMF) Steps 1-6 Process Overview

Risk Management Framework (RMF) - ANSWER-The RMF addresses the security concerns of organizations related t the design, developmet, implementation, operation, and disposal of information systems and the environments in which those systems operate. Step 1 Categorize - Information System Phase 1 - ANSWER-Categorize the information system based on the information type the system processes, stores, or transmits. SP 800-60 and FIPs Publication 199 to determine impact level (Low, Moderate or High) assigned to the security objectives-Confidentiality, Integrity and Availability (CIA). Highest watermark becomes the overall categorization of the system. Categorization Process Kick Off Mtg. 1st Artifact FIPS 199 - ANSWER-Starts with a kick off meeting System Owner (SO) Security Control Assessor/C&A Analyst Information System Security Officer (ISSO), AO, System Owner and Information Owner