System Specific: Security controls specific to an IS and the responsibility of the security officer.Control implementation can be characterized as: Step 3: Select Security Controls: Identify the security controls that are provided by the organization as common controls for all or multiple IS under the organization’s control and document the controls in the SSP.Quick Guide: NIST RMF Categorize Step FAQs.The impact values will be documented in the Security System Plan (SSP) along with the research, key decisions, approvals, and supporting rationale. Security impact levels are defined as Low, Moderate, or High. Step 2: Categorize System: Information Systems (IS) will be categorized based on the impact due to a loss of Confidentiality, Integrity, and Availability (CIA) of the information system (IS).Quick Guide: NIST RMF Prepare Step FAQs.Step 1: Prepare: Carry out essential activities at the organization, mission and business process, and information system levels of the enterprise to help prepare the organization to manage its security and privacy risks.The RMF process parallels the defense acquisition process from initiation and consists of seven (7) steps: Risk Management Framework (RMF) Tutorialħ Steps of the Risk Management Framework (RMF) Risk Management Framework (RMF) Steps Emphasizing information security continuous monitoring and timely correction of deficiencies, including active management of vulnerabilities and incidents.Codifying system authorization reciprocity enables organizations to accept approvals by other organizations for interconnection or reuse of IT without retesting.Providing a risk management methodology that gives organizations a true picture of vulnerabilities caused by non-compliant controls as it relates to other risk factors (e.g.Implementing a three-tiered approach to risk management that addresses risk-related concerns at the enterprise level, the mission and business process level, and the information system level.Incorporating cybersecurity early and robustly in the acquisition and system development life cycle.

Dod infosec website