Stage 2: Core

Outcome

The controls most systems depend on are required by approved policy, carried out by written procedures and measured by standards. Systems know which controls the organization provides for them to inherit.

Artifacts to produce

Family	Artifacts beyond the family policy	Main controls
Access control	Account management procedure; access request form; access review record; remote access standard	AC-2, AC-17
Awareness and training	Training plan; training record log	AT-2, AT-3, AT-4
Audit and accountability	Audit logging standard (event list); log review procedure	AU-2, AU-6
Configuration management	Configuration Management Plan; baseline configuration standard; change request form; component inventory	CM-9, CM-2, CM-6, CM-3, CM-8
Contingency planning	Contingency Plan; business impact analysis; test plan and after-action report	CP-2, CP-4
Identification and authentication	Identification and authentication standard	IA-2, IA-5
Incident response	Incident Response Plan; incident handling playbook; incident report form; tabletop exercise kit	IR-8, IR-4, IR-6, IR-3
Personnel security	Access agreement; onboarding, transfer and termination checklist	PS-6, PS-4, PS-5
Risk assessment	Vulnerability management standard	RA-5
System and communications protection	Encryption and key management standard; boundary protection standard	SC-8, SC-12, SC-13, SC-28, SC-7
PII processing and transparency (if you handle PII)	Privacy notice; privacy impact assessment	PT-5, RA-8

Each family also gets a decision worksheet listing the values its policy needs.

Templates available now

Artifact	Type	Main controls	Status
Access Control Policy	Policy	AC-1	Draft
Access Control Decision Worksheet	Decision worksheet	AC-1	Draft
Awareness and Training Policy	Policy	AT-1	Draft
Awareness and Training Decision Worksheet	Decision worksheet	AT-1	Draft
Audit and Accountability Policy	Policy	AU-1	Draft
Audit and Accountability Decision Worksheet	Decision worksheet	AU-1	Draft
Configuration Management Policy	Policy	CM-1	Draft
Configuration Management Decision Worksheet	Decision worksheet	CM-1	Draft
Contingency Planning Policy	Policy	CP-1	Draft
Contingency Planning Decision Worksheet	Decision worksheet	CP-1	Draft
Identification and Authentication Policy	Policy	IA-1	Draft
Identification and Authentication Decision Worksheet	Decision worksheet	IA-1	Draft
Incident Response Policy	Policy	IR-1	Draft
Incident Response Decision Worksheet	Decision worksheet	IR-1	Draft
Personnel Security Policy	Policy	PS-1	Draft
Personnel Security Decision Worksheet	Decision worksheet	PS-1	Draft
Personally Identifiable Information Processing and Transparency Policy	Policy	PT-1	Draft
Personally Identifiable Information Processing and Transparency Decision Worksheet	Decision worksheet	PT-1	Draft
System and Communications Protection Policy	Policy	SC-1	Draft
System and Communications Protection Decision Worksheet	Decision worksheet	SC-1	Draft
Access Agreement	Form or register	PS-6, PS-4, PS-8, PL-4	Draft
Access Request Form	Form or register	AC-2, AC-2(2), AC-5, AC-6, AC-6(2)	Draft
Access Review Record	Form or register	AC-2, AC-2(3), AC-5, AC-6(7)	Draft
Account Management Procedure	Procedure	AC-2, AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-2(13), AC-5, AC-6(7), PS-4	Draft
Audit Logging Standard	Standard	AU-2, AU-3, AU-3(1), AU-3(3), AU-4, AU-5, AU-8, AU-9, AU-9(4), AU-11, AU-12, AU-5(1), AU-5(2), AU-9(2), AU-9(3), AU-10, AU-12(1), AU-12(3)	Draft
Baseline Configuration Standard	Standard	CM-6, CM-6(1), CM-6(2), CM-2, CM-2(2), CM-2(3), CM-2(7), CM-7, CM-7(1)	Draft
Boundary Protection Standard	Standard	SC-7, SC-7(3), SC-7(4), SC-7(5), SC-7(7), SC-7(8), SC-7(18), SC-7(21), AC-4	Draft
Business Impact Analysis	Report	CP-2, CP-2(3), CP-2(8)	Draft
Change Request Form	Form or register	CM-3, CM-3(2), CM-4, CM-4(1), CM-4(2)	Draft
Component Inventory	Form or register	CM-8, CM-8(1), CM-8(2), CM-8(3), CM-8(4), PE-16, MP-7	Draft
Configuration Management Plan	Plan	CM-9, CM-1, CM-2, CM-2(3), CM-3, CM-3(1), CM-3(4), CM-5	Draft
Encryption and Key Management Standard	Standard	SC-8, SC-8(1), SC-12, SC-12(1), SC-13, SC-17, SC-28, SC-28(1)	Draft
Identification and Authentication Standard	Standard	IA-2, IA-2(1), IA-2(2), IA-2(8), IA-2(12), IA-5, IA-5(1), IA-5(2), IA-5(6), IA-3, IA-4, IA-4(4), IA-6, IA-7, IA-8, IA-8(1), IA-8(2), IA-8(4), IA-11, IA-12, AC-7	Draft
Incident Handling Playbook	Procedure	IR-4, IR-4(1), IR-5, IR-6, IR-6(1), IR-6(3), IR-7, IR-8(1)	Draft
Incident Report Form	Form or register	IR-6, IR-6(1), IR-5, IR-7, IR-8(1)	Draft
Incident Response Plan	Plan	IR-8, IR-8(1), IR-4, IR-5, IR-6, IR-7, IR-2, IR-3	Draft
Information System Contingency Plan	Plan	CP-2, CP-2(1), CP-2(3), CP-2(8), CP-6, CP-7, CP-8, CP-9, CP-10	Draft
Log Review Procedure	Procedure	AU-6, AU-6(1), AU-6(3), AU-6(5), AU-6(6), AU-7, AU-7(1)	Draft
Onboarding, Transfer and Termination Checklist	Form or register	PS-4, PS-5, PS-3, PS-6, PS-7, AC-2, AT-2	Draft
Privacy Impact Assessment	Report	RA-8, PT-2, PT-3, PT-4, PT-5, PT-7, PT-8, SC-7(24), RA-3	Draft
Privacy Notice	Form or register	PT-5, PT-5(2), PM-20, PM-20(1), PT-2, PT-3, PT-4, PT-7	Draft
Remote Access Standard	Standard	AC-17, AC-17(1), AC-17(2), AC-17(3), AC-17(4), AC-12, SC-10	Draft
Security and Privacy Training Plan	Plan	AT-2, AT-2(2), AT-2(3), AT-3, AT-3(5), AT-4, PM-13, PM-14	Draft
Tabletop Exercise Kit	Plan	IR-3, IR-3(2), IR-2(3), IR-4, IR-8	Draft
Training Record Log	Form or register	AT-4, AT-2, AT-3	Draft
Vulnerability Management Standard	Standard	RA-5, RA-5(2), RA-5(4), RA-5(5), RA-5(11)	Draft

Decisions to make

• The values each family policy leaves open: review frequencies, time limits, approvers. The decision worksheets list them with typical values.
• Which controls the organization provides centrally (for example the identity provider, logging platform or training) and which each system provides itself.
• Where the organization sets a stricter value than a baseline requires.

Roles

Role	Responsibility in this stage
Chief Information Security Officer	Owns the family policies and approves exceptions
Policy owners named in each policy	Write and maintain procedures and standards
Common control providers	Run the controls systems inherit and document them
System owners	Adopt the policies and record inheritance in their security plans

RMF Prepare tasks this stage carries out

From SP 800-37 Rev. 2; see the Prepare step page. The mapping is the author’s judgment.

Task	How this stage meets it
P-4 Tailored baselines and CSF profiles (optional)	Family policies set organization-wide values for baseline parameters
P-5 Common control identification	The list of centrally provided controls, recorded in the program plan and each security plan

Done when

• A policy is approved for each family in the baseline you chose.
• Each family’s decision worksheet is complete and its values are in the policy.
• Procedures exist for account management, log review, change control and incident handling.
• Common controls are listed with their provider, and systems record what they inherit.