How to use this guide

This guide is a working reference for the NIST Risk Management Framework (RMF) in SP 800-37 Rev. 2, for anyone taking a system to an authorization to operate (ATO) or keeping one. SP 800-37 Rev. 2 (December 2018) is still the current RMF; there is no Rev. 3. Agency and program processes (DoD, the Intelligence Community, FedRAMP) add their own rules on top, and where they differ, they govern. See Program variants.

Where to start

If you are	Start here	Then
Standing up a new system	Prepare (system-level tasks P-8 to P-18)	Work forward through each step in order
Inheriting a system with an ATO	ATO package checklist, then Monitor	Check the POA&M and the ATO expiry or ongoing-authorization terms
Facing a significant change	Monitor (task M-1)	Re-enter at Categorize or Select for the changed parts
An ISSO	Roles, then Select, Implement and Assess	Keep the SSP and POA&M current
A control assessor	Assess	The control pages for SP 800-53A objectives
An AO or AO designated representative	Authorize	ATO package checklist
A common control provider	Prepare (task P-5) and Select (task S-3)	Publish what tenants can inherit

Each step page follows the same layout: purpose, the tasks with who does them, how to apply the step in practice, a done checklist and common findings.

The RMF at a glance

The RMF is seven steps and 47 tasks that turn an organization’s risk tolerance into an authorization decision an official is accountable for. Prepare runs once at the organization level and again for each system; the other six steps repeat whenever the system or its threat picture changes.

The arrow that matters most is the loop: a significant change found in Monitor sends the system back to Categorize or Select for the affected parts, not back to square one.

Step	Question it answers	Key outputs	SDLC phase
0 Prepare	What are we protecting, why, and inside what boundary?	Roles, risk strategy, common control list, boundary, information types, system registration	Initiation (and organization-wide)
1 Categorize	How bad would a loss of confidentiality, integrity or availability be?	System description, FIPS 199 security category, approved categorization	Initiation
2 Select	Which controls, tailored how, and who provides them?	Tailored baseline, security and privacy plans (SSP), ConMon strategy	Development and acquisition
3 Implement	Are the controls built and documented as built?	Implemented controls, updated SSP, configuration baselines, evidence	Development and implementation
4 Assess	Do the controls work as intended?	Assessment plan (SAP), assessment report (SAR), remediation, POA&M	Implementation
5 Authorize	Is the remaining risk acceptable to the mission?	Authorization package, risk determination, decision letter	Implementation to operations
6 Monitor	Is it still acceptable today?	Change analysis, ongoing assessments, updated package, status reports, disposal plan	Operations, maintenance and disposal

Four ideas carry through every step:

• Risk, not checklists. Controls are chosen and judged against mission risk. The AO accepts residual risk; a clean control count is not the goal.
• Three tiers. SP 800-39 splits risk work across the organization (Tier 1), mission and business process (Tier 2) and system (Tier 3). Much of Prepare is Tier 1 and 2 work the system team should inherit, not redo.
• Inheritance. Common controls (data center, identity, logging, policy) are authorized once and inherited by many systems. Knowing what you inherit shrinks every later step.
• Life cycle, not event. Each step maps to a phase of the system development life cycle; the ATO is a checkpoint, and Monitor keeps it valid.

Core source documents

Document	What it governs	Current version (as of Sep 2026)	Used in
NIST SP 800-37 Rev. 2	RMF steps, tasks, roles, authorization types	Dec 2018; no Rev. 3	All steps
NIST SP 800-53 Rev. 5	Security and privacy control catalog	Release 5.2.0, Aug 27, 2025 (summary of changes)	Select, Implement
NIST SP 800-53B	Low, Moderate, High and privacy baselines	2020, updated Dec 2020	Select
NIST SP 800-53A Rev. 5	Assessment procedures and objectives	2022, with a matching 5.2.0 release	Assess, Monitor
FIPS 199	Security categorization (Low, Moderate, High)	2004	Categorize
FIPS 200	Minimum security requirements	2006	Select
NIST SP 800-60 Vol. 1 and 2 Rev. 1	Information types and provisional impact levels	2008; Rev. 2 in draft since Jan 2024	Prepare, Categorize
NIST SP 800-30 Rev. 1	Risk assessment method	2012	Prepare, Authorize, Monitor
NIST SP 800-137 and 800-137A	Information security continuous monitoring (ISCM)	2011 and 2020	Prepare, Select, Monitor
OMB Circular A-130	Federal policy requiring the RMF and ongoing authorization	2016	All steps

Since release 5.2.0, NIST publishes 800-53 updates through its Cybersecurity and Privacy Reference Tool (CPRT), with OSCAL and JSON downloads. Release 5.2.0 added SA-15(13), SA-24 and SI-2(7) and revised SI-7(12), focused on secure software updates.