What is the NIST Risk Management Framework (RMF)?
The NIST Risk Management Framework (RMF) is a structured seven-step process that an organisation uses to assess, manage and formally accept the security and privacy risks of an information system throughout its entire lifecycle. The RMF was developed by the US National Institute of Standards and Technology (NIST) and is described in NIST SP 800-37. It connects board-level risk management with concrete security controls for each system, from office applications to OT environments with SCADA, PLCs and engineering stations.
The RMF answers three questions: how critical is this system, which controls does it therefore need, and who takes responsibility for accepting the remaining risk?
🎯 What is the NIST RMF for?
The RMF began as a mandatory process for US federal systems. The FISMA act requires federal agencies to secure their information, and OMB Circular A-130 requires them to use the RMF to do so. In March 2014 the US Department of Defense replaced its own accreditation process, DIACAP, with the RMF through DoDI 8510.01.
The RMF aims to:
- Assess risk in a repeatable, transparent way, using the same steps for every system
- Make responsibilities explicit: who owns the system, who assesses it, who accepts the risk
- Base decisions on evidence, recorded in an authorisation package
- Build security and privacy in from the design phase rather than bolting them on afterwards
- Enable continuous monitoring, so a system stays secure after go-live and not only on the day it is delivered
Outside the US government the RMF is not mandatory, but many suppliers, defence contractors and critical infrastructure operators use it as a proven method for compliance and cybersecurity risk management.
🔁 What are the 7 steps of the NIST RMF?
The current version, NIST SP 800-37 Revision 2 from December 2018, has seven steps containing 47 tasks in total. The Prepare step was added in Rev. 2; the earlier 2010 version had six steps.
| Step | Core activity | Main output | Supporting publication |
|---|---|---|---|
| 1. Prepare | Set roles, risk strategy and risk tolerance; identify assets and the system boundary | Risk strategy, authorisation boundary, risk assessment | NIST SP 800-30, SP 800-39 |
| 2. Categorize | Determine the impact on confidentiality, integrity and availability | Category low, moderate or high | FIPS 199, SP 800-60 |
| 3. Select | Choose a control baseline and tailor it | Security and privacy plan | NIST SP 800-53, SP 800-53B |
| 4. Implement | Put controls in place and document how they were actually implemented | Updated plan (as implemented) | NIST SP 800-53 |
| 5. Assess | Verify that controls are in place and working as intended | Assessment report, remediation plan | SP 800-53A |
| 6. Authorize | A senior official accepts the residual risk, or does not | Authorisation decision (ATO or denial) | NIST SP 800-37 |
| 7. Monitor | Track changes, threats and controls on an ongoing basis | Status reports, ongoing authorisation | SP 800-137 |
The Prepare step works at two levels: seven tasks at organisation level (P-1 to P-7) and eleven at system level (P-8 to P-18). Monitor closes the loop: changes or new threats can trigger a new categorisation, extra controls or a new authorisation decision. This resembles the PDCA cycle, but the RMF places far more emphasis on formal accountability and evidence.
🧠 How do categorisation and authorisation work?
Two steps set the RMF apart from many other frameworks.
Categorisation is done per information type and per security objective of the CIA triad. Each combination receives an impact level of low, moderate or high under FIPS 199. The system as a whole then takes the highest level found: the high-water mark principle. A system with a single information type that has high availability impact is therefore treated as high overall. That category determines which baseline from NIST SP 800-53B is the starting point.
Authorisation is a deliberate management decision. An authorizing official, a senior executive with budget and mission responsibility, reviews the authorisation package: the security and privacy plans, the assessment report and the plan of action and milestones (POA&M) listing open deficiencies. The outcome is an authorization to operate (ATO), an authorization to use for shared or external services, a common control authorization for inheritable controls, or a denial. Risk is thus explicitly accepted by a named person instead of being carried silently.
📚 How does the RMF relate to other NIST publications and standards?
| Publication or standard | Role relative to the RMF |
|---|---|
| NIST SP 800-37 | Describes the RMF itself: steps, tasks, roles, inputs and outputs |
| NIST SP 800-30 | Risk assessment method used in Prepare and Monitor |
| NIST SP 800-53 | Control catalogue (Rev. 5, 20 families) used in Select and Implement |
| NIST SP 800-82 | OT guide with an OT overlay on SP 800-53 for low, moderate and high |
| NIST CSF | Strategic framework; SP 800-37 Rev. 2 uses CSF profiles in the Prepare step |
| ISO 27001 / ISO 27005 | Management system and risk method; similar goals, different approach |
| IEC 62443 | OT standards series with zones, conduits and security levels |
The key difference from ISO 27001 is focus. ISO 27001 certifies a management system for the whole organisation; the RMF authorises system by system. The NIST CSF describes what an organisation should achieve, while the RMF describes how an individual system is assessed and approved for use.
🏭 How do you apply the RMF in OT environments?
NIST SP 800-37 Rev. 2 explicitly lists industrial control systems and cyber-physical systems as within scope. In OT, however, you fill in the steps differently than in IT:
- Availability and safety first - when categorising, the impact on process availability and integrity usually outweighs confidentiality
- System boundary per installation - a production line with PLCs, HMI, historian and engineering station often forms a single authorisation boundary
- Use the OT overlay - NIST SP 800-82 adapts the SP 800-53 baselines, for example where automatic account lockout after failed logins would lock out an operator
- Assess without disturbing the process - assessments preferably take place in a test environment, during a shutdown or with passive methods rather than active scans or a penetration test on a running plant
- Compensating controls - where patching is not possible, network segmentation, jump servers with MFA and RBAC protect the system
- OT-appropriate monitoring - SIEM and anomaly detection provide the evidence for step 7
| OT component | Example RMF approach |
|---|---|
| Water treatment SCADA server | Categorised high for availability, so the high baseline with the OT overlay |
| Historian in the DMZ | Inheritable controls for logging and backup, verified in step 5 |
| Remote access to PLCs | Remote access controls with MFA, jump server and session recording |
| Patch policy | Step 4 for the procedure, step 7 to track the backlog through patch management |
🧭 How can you use the RMF in the Netherlands and the EU?
For Dutch and other European organisations the RMF is not a legal requirement, but it is a useful working model. Since 15 August 2026 the Dutch Cybersecurity Act, the national implementation of NIS2, has been in force. It requires appropriate, risk-based measures but does not prescribe a method. A practical approach:
- Set the risk appetite at board level and appoint an owner and an authorising executive for each system.
- Inventory your assets with an up-to-date asset inventory and define the boundary of each system.
- Categorise using FIPS 199 or the impact definitions from IEC 62443-3-2 and record the outcome in a risk register.
- Select controls from NIST SP 800-53 with the OT overlay, or map them to IEC 62443 requirements if your suppliers work with those.
- Assess and authorise formally, with a remediation plan for open findings.
- Monitor and reassess after changes and incidents, and at least once a year.
If you already run an ISO 27001 management system, the RMF mainly serves as a system-level method within it.
❓ Frequently asked questions
Is the NIST RMF mandatory in Europe?
The NIST RMF is only mandatory for US federal agencies and their systems, under FISMA and OMB Circular A-130. In Europe it is voluntary. Organisations do use it to give concrete shape to the risk-based duty of care in NIS2 and national laws such as the Dutch Cybersecurity Act.
What is the difference between the NIST RMF and the NIST CSF?
The NIST CSF is a strategic framework that describes which cybersecurity outcomes an organisation should achieve. The NIST RMF is a detailed process for categorising a single system, selecting and assessing controls and formally authorising it. The two complement each other: CSF profiles can be used in the RMF Prepare step.
What is an ATO in the NIST RMF?
An ATO (authorization to operate) is the formal decision by an authorizing official that the residual risk of a system is acceptable and that the system may go into operation. The decision is based on the authorisation package with the security and privacy plans, the assessment report and the plan of action and milestones. Without an ATO a US federal system may not go into production.
Which version of the NIST RMF is current?
The current version of the NIST RMF is set out in NIST SP 800-37 Revision 2, published in December 2018. That version added the Prepare step and integrated privacy and supply chain risk management. For controls the RMF refers to NIST SP 800-53 Rev. 5, whose release 5.2.0 appeared in August 2025.
Is the NIST RMF suitable for OT and industrial systems?
The NIST RMF is explicitly intended for industrial control systems and cyber-physical systems as well. In OT you combine it with NIST SP 800-82, which contains an OT overlay on the SP 800-53 controls. Assessments and monitoring must then be designed so they do not disturb the physical process.
How many tasks does the NIST RMF have?
The NIST RMF in SP 800-37 Rev. 2 has 47 tasks spread across seven steps. The Prepare step has the most with 18, Implement the fewest with 2. Each task describes inputs, outputs, responsible roles and the phase of the system lifecycle in which it applies.
📌 In summary
The NIST Risk Management Framework is a seven-step process in which you categorise risk per system, select and assess appropriate controls, and have a responsible executive formally accept the residual risk. With NIST SP 800-37 as the process, NIST SP 800-53 as the control catalogue and NIST SP 800-82 for OT, the RMF is a proven working model for risk management in IT and OT environments, also outside the US government.