Run the NIST RMF lifecycle with less manual effort
NIST RMF, published as NIST Special Publication 800-37 Revision 2, is the US government's Risk Management Framework for managing security and privacy risk in information systems and organisations. It organises risk management into seven steps, Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, made up of 47 tasks. It works alongside NIST SP 800-53 controls, which are selected and implemented through the RMF.
Is NIST RMF right for your organisation?
US federal agencies must apply the RMF to their information systems under OMB Circular A-130 and FISMA, and contractors that operate systems for those agencies are usually required to support it. Cloud providers seeking FedRAMP authorisation follow an RMF-based process. Other organisations adopt it voluntarily when they want a disciplined, life cycle approach to security and privacy risk.
It is a legal or regulatory requirement for organisations in scope.
- Issued by
- National Institute of Standards and Technology (NIST)
- Latest version
- Special Publication 800-37 Revision 2, December 2018
- Structure
- 7 steps and 47 tasks
- Applies to
- US federal information systems and contractors operating them; voluntary for others
- Legal basis
- FISMA and OMB Circular A-130
- Outcome
- Authorisation to operate (ATO) decision by an authorising official
- Related standard
- NIST SP 800-53 security and privacy controls
- Type
- Framework (mandatory)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
NIST SP 800-37 Rev. 2 is mapped in OneClickComply's control library and available on request, so you can track RMF tasks against one set of controls shared with SP 800-53, ISO 27001 and other frameworks. Automated evidence collection, continuous monitoring and a built-in risk register support the Assess, Authorize and Monitor steps. Our in-house audit team and Ask an Auditor help you interpret tasks and prepare authorisation packages.
Requirements covered
47 tasks across seven steps: Prepare (P-1 to P-18, split into organisation and system level), Categorize (C-1 to C-3), Select (S-1 to S-6), Implement (I-1 and I-2), Assess (A-1 to A-6), Authorize (R-1 to R-5) and Monitor (M-1 to M-7).
Manual NIST RMF vs. OneClickComply
- Tracking 47 tasks across seven steps in spreadsheets
- Chasing screenshots for every control assessment
- Rebuilding system security plans after every change
- Keeping plans of action and milestones up to date by hand
- Ongoing monitoring that slips between authorisation cycles
- One control library maps every RMF task in one place
- Evidence collected automatically from connected tools
- Control documentation kept current as your environment changes
- Deficiencies tracked through to remediation in the risk register
- Continuous monitoring that supports ongoing authorisation
Everything you need for NIST RMF
All 47 RMF tasks mapped to shared controls in one library
Automated evidence collection for control assessments
Continuous monitoring with alerts when controls drift
Risk register for risk determination and response
AutoComplete policies built from your real environment
Ask an Auditor support for authorisation packages
Three steps to NIST RMF compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST RMF and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST RMF-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-37 Rev. 2 (Risk Management Framework) requirements
All 47 RMF tasks across the seven steps, using NIST's official task numbers and titles (P-1 to P-7 are organisation level, P-8 to P-18 system level).
| Reference | Requirement |
|---|---|
| Task P-1 | Risk Management Roles |
| Task P-2 | Risk Management Strategy |
| Task P-3 | Risk Assessment: Organization |
| Task P-4 | Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (optional) |
| Task P-5 | Common Control Identification |
| Task P-6 | Impact-Level Prioritization (optional) |
| Task P-7 | Continuous Monitoring Strategy: Organization |
| Task P-8 | Mission or Business Focus |
| Task P-9 | System Stakeholders |
| Task P-10 | Asset Identification |
| Task P-11 | Authorization Boundary |
| Task P-12 | Information Types |
| Task P-13 | Information Life Cycle |
| Task P-14 | Risk Assessment: System |
| Task P-15 | Requirements Definition |
| Task P-16 | Enterprise Architecture |
| Task P-17 | Requirements Allocation |
| Task P-18 | System Registration |
| Task C-1 | System Description |
| Task C-2 | Security Categorization |
Always check the official NIST RMF text for the exact wording.
NIST RMF FAQs
What is NIST SP 800-37 Rev. 2?
NIST SP 800-37 Rev. 2 is the Risk Management Framework (RMF) published by the US National Institute of Standards and Technology in December 2018. It gives a seven step process, Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, for managing security and privacy risk across an information system's life cycle, made up of 47 defined tasks.
Who must comply with the NIST RMF?
US federal agencies must apply the RMF to their information systems, as required by OMB Circular A-130 under FISMA. Contractors and service providers operating systems on behalf of agencies are usually bound by contract to support it. Private organisations outside government have no legal obligation but often adopt the RMF voluntarily as a structured risk management approach.
What are the seven steps of the NIST RMF?
The seven RMF steps are Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. Prepare sets context at organisation and system level, Categorize rates the system's impact, Select and Implement choose and deploy controls, Assess tests them, Authorize is the senior official's risk acceptance decision, and Monitor keeps controls and risk under ongoing review.
What changed in Revision 2 of SP 800-37?
Revision 2 added the Prepare step, integrated privacy risk management alongside security, aligned the RMF with the NIST Cybersecurity Framework, and added supply chain risk management considerations. It also introduced an organisation-generated approach to control selection and stronger links to systems engineering. Revision 1 was withdrawn after a transition period and replaced by Revision 2.
How does the NIST RMF relate to NIST SP 800-53?
The RMF is the process and SP 800-53 is the control catalogue it uses. During the Select step you choose and tailor controls from SP 800-53, using baselines from SP 800-53B, then implement, assess and monitor them through the remaining RMF steps. The two documents are designed to be used together for federal systems.
How does the NIST RMF compare with ISO 27001?
Both are risk based, but they serve different purposes. ISO 27001 defines a certifiable information security management system for any organisation, while the RMF is a US government process ending in an authorisation decision for a specific system. Many controls overlap, so evidence gathered for one can support the other when controls are mapped across both.
What happens if a system fails RMF authorisation?
If the authorising official judges the risk unacceptable, the system is denied authorisation to operate and should not run, or must stop operating, until the risk is reduced. Deficiencies are normally recorded in a plan of action and milestones, remediated, and reassessed before a new authorisation decision is requested.
Does OneClickComply support NIST SP 800-37?
NIST SP 800-37 Rev. 2 is mapped in OneClickComply's control library and available on request, rather than live as a standard self-serve framework today. Once enabled, its tasks share controls with SP 800-53, ISO 27001 and other frameworks, so evidence collected once counts towards each. Contact us to discuss enabling it for your organisation.
Related standards
All standards- NIST Cybersecurity Framework 2.0Framework · US
- NIST Privacy FrameworkFramework · US
- NIST AI Risk Management Framework 1.0Framework · US
- NIST SP 800-218 Secure Software Development Framework (SSDF)Framework · US
- NIST SP 800-53 Rev. 5Standard · US
- NIST SP 800-82 Rev. 3Guidance · US
- NIST SP 800-53 Rev. 4Standard · US
- NIST SP 800-171A Rev. 3Guidance · US
Get NIST RMF ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.