Stage 3: Operate

Outcome

Controls are assessed on a schedule, every weakness found is tracked to closure, and monitoring tells the organization when risk changes between assessments.

Artifacts to produce

Family	Artifacts	Main controls
Assessment, authorization and monitoring	Assessment plan and report; POA&M; Continuous Monitoring Strategy; information exchange agreement	CA-2, CA-5, CA-7, CA-3
System and information integrity	Patch and flaw remediation standard; system monitoring standard	SI-2, SI-4
System and services acquisition	Secure Software Development Policy and SDLC standard; acquisition security requirements; external service review	SA-3, SA-8, SA-15, SA-4, SA-9
Maintenance	Maintenance log	MA-2
Media protection	Media sanitization record	MP-6
Physical and environmental protection	Physical access list; visitor log	PE-2, PE-8

Templates available now

Artifact	Type	Main controls	Status
Assessment, Authorization, and Monitoring Policy	Policy	CA-1	Draft
Assessment, Authorization, and Monitoring Decision Worksheet	Decision worksheet	CA-1	Draft
Maintenance Policy	Policy	MA-1	Draft
Maintenance Decision Worksheet	Decision worksheet	MA-1	Draft
Media Protection Policy	Policy	MP-1	Draft
Media Protection Decision Worksheet	Decision worksheet	MP-1	Draft
Physical and Environmental Protection Policy	Policy	PE-1	Draft
Physical and Environmental Protection Decision Worksheet	Decision worksheet	PE-1	Draft
System and Services Acquisition Policy	Policy	SA-1	Draft
System and Services Acquisition Decision Worksheet	Decision worksheet	SA-1	Draft
System and Information Integrity Policy	Policy	SI-1	Draft
System and Information Integrity Decision Worksheet	Decision worksheet	SI-1	Draft
Acquisition Security Requirements	Standard	SA-4, SA-4(1), SA-4(2), SA-4(5), SA-4(9), SA-4(10), SA-5, SA-10, SA-11, SA-15, SA-15(3), SA-22, SR-5, PS-7	Draft
Contingency Plan After-Action Report	Report	CP-4, CP-2	Draft
Contingency Plan Test Plan	Plan	CP-4, CP-4(1), CP-4(2), CP-3(1), CP-9(2)	Draft
Continuous Monitoring Strategy	Plan	CA-7, CA-7(1), CA-7(4), PM-31, CA-2, CA-5, CA-6	Draft
External Service Review	Form or register	SA-9, SA-9(2), SA-4, CA-3, CA-5	Draft
Information Exchange Agreement	Form or register	CA-3, CA-3(6), SA-9	Draft
Maintenance Log	Form or register	MA-2, MA-2(2), MA-3, MA-3(1), MA-3(2), MA-3(3), MA-4, MA-4(3), MA-5, MA-5(1)	Draft
Media Sanitization Record	Form or register	MP-6, MP-6(1), MP-6(2), MP-6(3), MP-4, MP-5, MA-2, MA-3(3)	Draft
Patch and Flaw Remediation Standard	Standard	SI-2, SI-2(2), SI-3, SI-5, SI-7(15)	Draft
Physical Access List	Form or register	PE-2, PE-3, PE-3(1), PS-4, PS-5	Draft
Plan of Action and Milestones (POA&M)	Form or register	CA-5, CA-7, PM-4	Draft
Security and Privacy Assessment Plan	Plan	CA-2, CA-2(1), CA-2(2), CA-8, CA-7(1)	Draft
Security and Privacy Assessment Report	Report	CA-2, CA-2(1), CA-5, CA-6, CA-7	Draft
System Monitoring Standard	Standard	SI-4, SI-4(2), SI-4(4), SI-4(5), SI-4(10), SI-4(12), SI-4(14), SI-4(20), SI-4(22), AU-6, AU-11	Draft
Visitor Log	Form or register	PE-8, PE-8(1), PE-8(3), PE-3	Draft

Decisions to make

• How often each control is assessed, and which are monitored continuously by automation.
• Deadlines for fixing weaknesses by severity, and who may accept a risk instead.
• Which external services need a security review before use, and how often after.

Roles

Role	Responsibility in this stage
Control assessor	Plans and runs assessments; writes the report
System owner	Keeps the POA&M current and fixes weaknesses
Authorizing official	Accepts residual risk and decides whether the system may operate
Chief Information Security Officer	Owns the Continuous Monitoring Strategy and reports risk to leadership

RMF Prepare tasks this stage carries out

From SP 800-37 Rev. 2; see the Prepare step page. The mapping is the author’s judgment.

Task	How this stage meets it
P-7 Continuous monitoring strategy, organization	The Continuous Monitoring Strategy

Done when

• Each system has a current assessment report.
• Every open weakness is in a POA&M with an owner and a date.
• The Continuous Monitoring Strategy is approved and its reports reach the authorizing officials.
• Patching and monitoring run to the standards, with records to show it.