CISO live

 

NIST CSF 2.0 - Govern

 

NIST Risk Management Framework (RMF) FAQ

 What is the NIST Risk Management Framework (RMF)?

The NIST Risk Management Framework (RMF) is an overarching framework and methodology developed by the National Institute of Standards and Technology (NIST) to help organizations manage risk and secure their systems and information. It provides a structured process for framing, assessing, mitigating, and reducing risk within an organization.

What is the purpose and scope of the RMF?

The RMF's primary purpose is to assist organizations in establishing a formalized risk management program, assessing risk periodically to ensure it doesn't exceed their tolerance, and developing strategies to respond to identified risks. Its scope encompasses the entire information security lifecycle of systems and information within an organization.

Who is required to implement the NIST RMF?

All United States government organizations are required to implement the Risk Management Framework in some form. The framework was originally developed by NIST to implement the Federal Information Security Management Act (FISMA) of 2002.

What are the seven steps of the RMF process?

The RMF process is an iterative process that occurs throughout a system's lifecycle. The seven steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.

What are some key NIST Special Publications related to the RMF?

Several NIST Special Publications (SPs) are essential for implementing the RMF. Some notable ones mentioned include:

SP 800-39: Managing Information Security Risk

SP 800-37: Risk Management Framework for Information Systems and Organizations (the core RMF publication)

SP 800-30: Guide for Conducting Risk Assessments

SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations (the NIST control set)

SP 800-53A Revision 5: Assessing Security and Privacy Controls in Federal Information Systems and Organizations (guidance for assessing controls)

SP 800-53B: Control Baselines for Information Systems and Organizations (provides control baselines for systems with specific characteristics)

What is the role of NIST SP 800-53 Revision 5 within the RMF?

NIST SP 800-53 Revision 5 is particularly famous for its comprehensive set of security and privacy controls. While the RMF provides the overall methodology for risk management, SP 800-53 provides the specific controls that organizations can select and implement to address identified risks based on their system categorization and risk assessments.

How does the RMF address both security and privacy?

The RMF, as highlighted in NIST SP 800-53 Revision 5, incorporates both security and privacy controls. The publications and controls address managing personally identifiable information (PII), ensuring transparency in data processing, and developing policies and procedures that encompass both security and privacy considerations.

How is the RMF and its related publications updated?

The NIST Special Publications, including SP 800-53, undergo revisions to stay current with evolving threats and best practices. The excerpts show examples of editorial controls and incorporated content from previous revisions or related publications, demonstrating an ongoing effort to maintain and enhance the framework and its supporting documentation.

NIST Flow chart to Incident eradication and recovery

Promover a transparência na supervisão dos riscos da segurança cibernética em empresas

O projeto de lei define uma ameaça de segurança cibernética como qualquer ação não protegida pela Primeira Emenda que "pode resultar em um esforço não autorizado para impactar negativamente a segurança, a disponibilidade, a confidencialidade ou a integridade de um sistema de informação ou informações armazenadas, Processado por, ou transitando um sistema de informação ... "

O projeto de lei, em seguida, propõe apenas três requisitos sob a égide da Comissão de Valores Mobiliários (SEC): que os relatórios anuais à SEC deve divulgar o nível de conhecimentos de segurança cibernética do conselho; Ou, caso não exista, quais "outras medidas de segurança cibernética tomadas pela empresa relatora foram levadas em conta"; E que a definição do que constitui essa especialização deve vir da SEC em consulta com o NIST.

https://www.congress.gov/115/bills/s536/BILLS-115s536is.pdf 

Em conjunto, esses dois exemplos de novas regulamentações sugerem que as autoridades reguladoras não estão mais satisfeitas em formular recomendações sobre a responsabilidade de segurança no nível de diretoria, mas estão agora prontas para exigir legalmente.

A implicação é que já não é suficiente que as organizações devem ter conselhos de segurança no conselho, ele vai se tornar cada vez mais uma exigência legal.