What is NIST SP 800-37?
NIST SP 800-37 is the publication of the US National Institute of Standards and Technology that defines the NIST Risk Management Framework (RMF): a process of seven steps and 47 tasks with which an organisation manages the security and privacy risks of an information system throughout its lifecycle and has them formally accepted. The current version is Revision 2 from December 2018, titled Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. Where the RMF article explains what the steps are, this article is about the document itself: its structure, roles, authorisation types and how you use it in IT and OT environments.
SP 800-37 is mandatory for US federal systems through FISMA and OMB Circular A-130, but it is used worldwide as a working model for risk-based compliance.
🧠 What exactly does NIST SP 800-37 describe?
NIST SP 800-37 Rev. 2 was produced by the Joint Task Force, a collaboration between NIST, the US Department of Defense and the intelligence community. The document runs to 183 pages and consists of three chapters and eight appendices:
- Chapters 1 and 2 - purpose, scope and fundamentals: risk management at three levels (organisation, mission/business process, information system) following SP 800-39, the relationship between security and privacy, and the concept of the system boundary
- Chapter 3 - the process itself: all 47 tasks across the seven steps
- Appendix D - roles and responsibilities
- Appendix E - a summary table of every task with its owner and supporting roles
- Appendix F - authorisation decisions, authorisation packages, ongoing authorisation and the triggers for reassessment
- Appendices G and H - defining the authorisation boundary and fitting the RMF into the system life cycle (lifecycle management)
Notable for OT: the definition of information system in SP 800-37 explicitly includes industrial and process control systems, cyber-physical systems and embedded sensors. The RMF is therefore not meant for office IT alone.
📜 How has NIST SP 800-37 evolved?
| Version | Date | Title and core |
|---|---|---|
| SP 800-37 | May 2004 | Guide for the Security Certification and Accreditation of Federal Information Systems: the classic certification and accreditation (C&A) process |
| Rev. 1 | February 2010, updated June 2014 | Guide for Applying the Risk Management Framework to Federal Information Systems: C&A replaced by the RMF with six steps |
| Rev. 2 | 20 December 2018 | Risk Management Framework for Information Systems and Organizations: seven steps with the new Prepare step, privacy fully integrated |
Rev. 1 was withdrawn on 20 December 2019, one year after Rev. 2 appeared. NIST set seven objectives for that update:
- Closer linkage between the C-suite and the system and operational level
- Institutionalising preparation through the Prepare step
- Alignment with the NIST CSF, so that CSF profiles can be used within the RMF
- Integrating privacy risk management alongside information security
- Linking systems engineering to the life cycle processes of SP 800-160 Volume 1
- Including supply chain risk, such as counterfeit components, tampering and malicious code (see Supply Chain Risk)
- Organisation-generated control selection alongside the fixed baselines, matching the NIST SP 800-53 Rev. 5 catalogue
🔁 Which steps and tasks does SP 800-37 contain?
| Step | Tasks | Key question |
|---|---|---|
| Prepare | P-1 to P-18 (7 at organisation level, 11 at system level) | Are roles, risk strategy and system boundary defined? |
| Categorize | C-1 to C-3 | How large is the impact on confidentiality, integrity and availability? |
| Select | S-1 to S-6 | Which SP 800-53 controls are needed, and which are inherited? |
| Implement | I-1 and I-2 | Have the controls been implemented and documented as such? |
| Assess | A-1 to A-6 | Do the controls work as intended? |
| Authorize | R-1 to R-5 | Does an accountable senior official accept the residual risk? |
| Monitor | M-1 to M-7 | Does the risk remain acceptable as changes and new threats arise? |
A detailed explanation of each step, including FIPS 199 categorisation and the high-water mark principle, is given under the NIST Risk Management Framework. For the risk analysis itself SP 800-37 refers to NIST SP 800-30, for continuous monitoring to SP 800-137 and for the supply chain to SP 800-161.
🔧 How is an RMF task in SP 800-37 structured?
Every task follows the same fixed format, which makes the document usable as a checklist:
- Potential inputs - the information you need, such as the risk management strategy or an asset inventory
- Expected outputs - the result, such as a system description or assessment report
- Primary responsibility - the role that remains accountable, even when the work is delegated
- Supporting roles - the roles that contribute
- System development life cycle phase - the phase in which the task falls, for new or existing systems
- Discussion and references - explanation plus pointers to other NIST publications and CSF categories
Appendix D describes the roles. The most important ones:
| Role | Responsibility |
|---|---|
| Head of Agency | Ultimately responsible for risk management across the organisation |
| Risk Executive (Function) | Organisation-wide risk strategy and consistent risk decisions |
| Authorizing Official (AO) | Accepts the residual risk and makes the authorisation decision |
| System Owner | Responsible for development, operation and documentation of the system |
| Control Assessor | Independently checks whether controls are effective |
| Common Control Provider | Provides controls that multiple systems inherit |
| Senior Agency Information Security Officer | Leads the security programme, comparable to the CISO |
🔐 Which types of authorisation does SP 800-37 recognise?
Appendix F makes the RMF more flexible than is often assumed. There are three kinds of decision: an authorization to operate (ATO) for a system, an authorization to use (ATU) for shared or external services such as cloud, and a common control authorization for inheritable controls. Each can also be denied.
In addition, SP 800-37 distinguishes:
- Initial authorisation, ongoing authorisation and reauthorisation - under ongoing authorisation the fixed termination date can be dropped, provided the monitoring programme delivers sufficiently current evidence
- Type authorisation - a single authorisation package for an archetype deployed identically at multiple locations; each site then issues an ATU
- Facility authorisation - common controls of a location, such as physical protection and contingency plans, which systems at that location inherit
- Traditional and joint authorisation - a single AO, or multiple AOs who share accountability
Reassessment is started by event-driven triggers: a new operating system or hardware platform, changed ports, protocols or services, modified cryptography, moving to a new facility, or credible threat information that the organisation is being targeted. Only the affected controls are reassessed.
🏭 How do you apply SP 800-37 in OT environments?
The preface of Rev. 2 names reducing the IT/OT footprint and attack surface as an explicit goal. In OT you translate the tasks as follows:
| RMF step | Example in an OT context |
|---|---|
| Prepare | Define roles for PLC administrators, process owners and integrators |
| Categorize | Classify SCADA, Historian and HMI, with emphasis on availability and integrity |
| Select | Choose Firewall, Access Control, MFA and Monitoring, using the OT overlay from NIST SP 800-82 |
| Implement | Configure a Jump Server with logging and role-based access |
| Assess | Test Remote Access during a shutdown or with passive methods |
| Authorize | The accountable manager accepts the residual risk in writing before commissioning |
| Monitor | SIEM and anomaly detection in the control zone provide continuous evidence |
Two authorisation types fit OT particularly well. A type authorisation suits a standardised control cabinet or a standard pumping station design installed at dozens of sites. A facility authorisation covers the physical security, network segmentation and contingency plans of one plant, so that individual systems can inherit them. In SP 800-37 terms, a PLC firmware update is an event-driven trigger, which you tie to a targeted reassessment through change management.
🔄 How does SP 800-37 relate to other frameworks?
| Framework | Relationship to SP 800-37 |
|---|---|
| NIST SP 800-53 | Supplies the catalogue of security and privacy controls for Select and Implement |
| NIST SP 800-30 | Risk assessment method used in Prepare and Monitor |
| NIST CSF | Strategic framework; CSF profiles feed the Prepare step |
| NIST SP 800-82 | OT guide with an overlay on the SP 800-53 baselines |
| IEC 62443-2-1 | Requirements for the asset owner’s security programme in OT |
| ISO 27001 | Organisation-wide management system; SP 800-37 works per system |
The RMF resembles the PDCA cycle, but places more emphasis on formal accountability, evidence and a named senior official who accepts the risk.
🧭 How do you use SP 800-37 as a European organisation?
Outside the US federal government SP 800-37 is voluntary. The US Department of Defense replaced its own DIACAP process with the RMF in 2014, so defence suppliers encounter it. In the Netherlands, the Cyberbeveiligingswet, in force since 15 August 2026 as the Dutch implementation of NIS2, requires risk-based measures without prescribing a method. SP 800-37 is then a proven way to fill that in:
- Assign per system an owner and an authorising senior official.
- Define the system boundary based on an up-to-date asset inventory.
- Use the task format as a checklist and record the outcomes in a risk register.
- Define your triggers for reassessment, such as firmware updates or new external connections.
- Move to ongoing authorisation once monitoring provides reliable evidence.
❓ Frequently asked questions
Which version of NIST SP 800-37 is current?
The current version is NIST SP 800-37 Revision 2, published on 20 December 2018. This version added the Prepare step and integrated privacy and supply chain risk management into the RMF. Revision 1 from 2010 was withdrawn on 20 December 2019.
What is the difference between NIST SP 800-37 and the NIST RMF?
The NIST RMF is the seven-step risk management process, and NIST SP 800-37 is the publication that describes that process. SP 800-37 specifies the inputs, outputs, roles and life cycle phase of each task. In practice the two names are often used interchangeably.
What is the difference between NIST SP 800-37 and NIST SP 800-53?
NIST SP 800-37 describes the process for managing risk and authorising a system. NIST SP 800-53 is the catalogue of controls from which you select during that process. SP 800-37 tells you how to work, SP 800-53 which controls are available.
Is NIST SP 800-37 suitable for OT and industrial systems?
NIST SP 800-37 explicitly names industrial control systems and cyber-physical systems as information systems within its scope. For OT you combine it with the overlay in NIST SP 800-82. Type and facility authorisations suit standardised installations deployed at multiple sites.
What is ongoing authorisation in NIST SP 800-37?
Ongoing authorisation means the authorizing official reassesses the risk continuously based on continuous monitoring, instead of carrying out a full reauthorisation every few years. The fixed termination date of the authorisation can then be dropped. It does require a monitoring programme that delivers current and reliable evidence.
Is NIST SP 800-37 mandatory in Europe?
NIST SP 800-37 is not a legal requirement in Europe; the obligation applies to US federal systems through FISMA. European organisations do use it to give concrete shape to the risk-based duty of care under NIS2 and national laws such as the Dutch Cyberbeveiligingswet. A US defence or government customer may also require it contractually.
📌 In summary
NIST SP 800-37 Rev. 2 is the guide to the NIST Risk Management Framework and sets out in 47 tasks who does what to categorise, protect, assess and formally authorise a system. With ongoing authorisation, type and facility authorisations and clear triggers for reassessment, the document is also a practical working model for risk management in OT environments.