Reference library

The core RMF documents are listed in How to use this guide. These are the supporting laws, policies and guides the rest of the site cites.

Document	Topic	Version	Used in
FISMA 2014	Law requiring agency security programs	2014	All steps
SP 800-39	Organization-wide risk management, three tiers	2011	Prepare, Authorize
SP 800-18 Rev. 2	Writing system security, privacy and supply chain risk management plans	2026	Select
SP 800-47 Rev. 1	Interconnection security	2021	Prepare, Implement
SP 800-115	Technical testing and assessment	2008	Assess
SP 800-128	Security-focused configuration management	2011, updated 2019	Implement, Monitor
SP 800-34 Rev. 1	Contingency planning	2010	Implement
SP 800-61 Rev. 3	Incident response, aligned with CSF 2.0	2025	Implement, Monitor
SP 800-63-4	Digital identity	2025	Select, Implement
SP 800-88 Rev. 2	Media sanitization	Sep 2025	Monitor (disposal)
SP 800-160 Vol. 1 Rev. 1	Systems security engineering	2022	Prepare, Implement
SP 800-161 Rev. 1	Cyber supply chain risk management	2022, updated 2024	Select, Implement
SP 800-171 Rev. 3	Protecting CUI in nonfederal systems	2024	Program variants
SP 800-218	Secure Software Development Framework	2022	Implement
NIST CSF 2.0	Cybersecurity Framework and profiles	Feb 2024	Prepare
CNSSI 1253	NSS categorization, baselines and overlays	Check the CNSS site	Categorize, Select
OSCAL	Machine-readable SSP, SAP, SAR and POA&M	Current release on site	Select through Monitor
NARA CUI Registry	CUI categories	Living list	Prepare, Categorize

Sources for current-status facts

Checked September 27, 2026: NIST news on SP 800-53 release 5.2.0, release 5.2.0 summary of changes, SP 800-60 Rev. 2 draft, SP 800-88 Rev. 2, Crowell on FedRAMP Consolidated Rules 2026, FedRAMP 20x, Breaking Defense on CSRMC and Akin on CSRMC.