Skip to content
RMF Field Guide

Apply the NIST RMF to real systems

A practitioner's guide to the Risk Management Framework and SP 800-53 controls. What each step asks for, how to do it well, and what assessors and authorizing officials look for.
Start with the RMFBrowse the controls

What’s in the guide

Section titled “What’s in the guide”
The Risk Management FrameworkAll seven steps and 47 tasks from SP 800-37, with owners, outputs, checklists and common findings.
SP 800-53 controlsEvery Rev. 5 control with its baselines, enhancements and assessment objectives, plus implementation guidance.
Industry guidesHow the RMF and 800-53 map onto healthcare, finance, energy, defense and other regulated sectors.
Technology playbooksControl implementation on specific platforms: cloud, identity, endpoints, containers and more.

About

Section titled “About”

This guide is a research project directed by Kristopher Stone, CISSP, an AI security lead working on federal systems. It began as a test of Claude Opus 5.5, Anthropic’s model, which writes most, if not all, of the content. Kristopher sets the scope, makes the decisions, and reviews and merges every change; pages marked draft are not yet reviewed. It is an ongoing work in progress, built on NIST publications, and is not an official NIST or government product. Read how the guide is made.

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.