Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Reference · In review

RMF Map

The Risk Management Framework, step by step, across the books: each NIST SP 800-37 Rev. 2 task, where the workbook treats it, the evidence it produces, and where it stops

Research under review: a map of the seven NIST Risk Management Framework steps and their 47 tasks onto the Federal Modernization Workbook’s books and chapters, with the evidence each produces, the kits that generate it, and an honest list of what the workbook doesn’t cover. For ISSOs, control assessors and authorizing officials.
Modified

November 8, 2026

Status — In review

This page is under review and is not yet part of the workbook's production guidance. Its claims are sourced, but its analysis and any recommendation are the program's working view; they may change before review is complete, and they are not endorsed by any federal agency. Last reviewed 2026-11-08.

An ISSO, a control assessor or an authorizing official reads the workbook with one question: where is the Risk Management Framework, and what does each step leave behind? The books answer it, but chapter by chapter. This page puts the answer in one place. For each of the seven steps of NIST SP 800-37 Rev. 2 it lists the tasks, the outputs NIST names, where the workbook treats each one, the evidence the program and its kits produce, and where the workbook stops.1

The Federal Framework Crosswalk’s RMF row is derived from this map’s marks; where they differ, this map wins. The M-19-17 and FICAM Crosswalk does the same job for identity.

ImportantFISMA isn’t a level

FISMA is a statute. It requires each agency to run an agency-wide information security program, with testing “no less than annually,” and gives the agency head, the CIO and the senior agency information security officer their duties.2 It defines no impact levels. “FISMA Moderate” is shorthand for three separate facts: the system’s FIPS 199 categorization rates confidentiality, integrity and availability;3 FIPS 200’s high-water mark makes the system moderate when at least one is moderate and none is high;4 and the SP 800-53B moderate baseline was then selected and tailored. A FedRAMP certification class is a fourth fact, about a provider’s service, not the agency’s system. Book 14, Chapter 01 traces all of them.

How to read this map

  • Task names are NIST’s, from SP 800-37 Rev. 2, Chapter 3 and Appendix E, read November 2, 2026; chapter links and anchors re-checked November 6, 2026.5 The organization-level Prepare tasks are P-1 to P-7 and the system-level ones P-8 to P-18; the other steps run C-1 to C-3, S-1 to S-6, I-1 and I-2, A-1 to A-6, R-1 to R-5 and M-1 to M-7.
  • Coverage is judged from what the chapters actually say:
    • Covered: the chapter tells the reader what the task requires, who does it, and what evidence shows it done.
    • Partial: the requirement is explained, but the workbook stops short of the artifact, or treats only part of the task.
    • Partial by design: the workbook gives the method, a neutral fill-in template and a Copilot prompt, and stops there on purpose, because the content or the decision is the agency’s. The template is the most a public workbook can supply, so this mark doesn’t move to Covered.
    • Not covered: nothing in the books does the task.
  • Evidence names the artifact an assessor would read. Where a kit in the repository’s examples folder produces it, the kit is named. Every kit is illustrative: tested against fixtures, not proven against a production tenant.
  • Design guidance is marked as such. The cadences, dispositions and freshness limits in Book 14 are the program’s design, not a federal requirement; the books say so where they set them.

The steps at a glance

The RMF runs top to bottom once, then loops through Monitor. A significant change can send a system back to an earlier step. Across the 47 tasks the marks are 24 Covered, 14 Partial, 9 Partial by design, 0 Not covered.

Step NIST’s purpose for the step Tasks Main outputs Deepest treatment in the workbook Coverage
1. Prepare ↓ “Essential activities to prepare the organization to manage security and privacy risks” P-1 to P-18 Roles, risk management strategy, tailored baselines, common controls, continuous monitoring strategy, authorization boundary, information types, requirements Book 14, Ch 05 and Ch 10; Book 10 for the boundary; Book 14, Appendix G for the templates 7 Covered, 7 Partial, 4 Partial by design
2. Categorize ↓ “Categorize the system and information processed, stored, and transmitted based on an impact analysis” C-1 to C-3 System description; FIPS 199 categorization using SP 800-60; approval Book 14, Ch 01; Book 14, Appendix F for the worked example 3 Partial by design
3. Select ↓ “Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)” S-1 to S-6 Selected and tailored baseline; common, hybrid and system-specific allocation; security and privacy plans with implementation statements; system monitoring strategy Book 14, Ch 03 and Ch 10; every book’s requirements-mapping appendix 3 Covered, 3 Partial
4. Implement ↓ “Implement the controls and document how controls are deployed” I-1, I-2 Controls in place; as-implemented record Books 02 to 12, 15, 17 and 18; Book 13, Ch 04 2 Covered
5. Assess ↓ “Assess to determine if the controls are in place, operating as intended, and producing the desired results” A-1 to A-6 Assessment plan (SAP), assessment report (SAR), remediation, POA&M Book 14, Ch 11; Appendix C and Appendix D for the templates 3 Covered, 1 Partial, 2 Partial by design
6. Authorize ↓ “Senior official makes a risk-based decision to authorize the system (to operate)” R-1 to R-5 Authorization package, risk determination, risk response, authorization decision, reporting Book 14, Ch 11; Book 13, Ch 09 3 Covered, 2 Partial
7. Monitor ↻ “Continuously monitor control implementation and risks to the system” M-1 to M-7 Change and significant-change analysis, ongoing assessments, package updates, reporting, ongoing authorization, disposal Book 12, Ch 12; Book 14, Ch 11; Book 14, Appendix E for change analysis 6 Covered, 1 Partial

Purposes are quoted from NIST’s RMF overview page.6

Step 1 — Prepare

Prepare is the step SP 800-37 Rev. 2 added, and the one the workbook treats least evenly. The organization-level tasks are where an agency’s own policy lives. A workbook can explain them and give their shape, but it can’t write them, so Book 14, Appendix G supplies templates for three of them and leaves the content to the agency.

Task NIST outcome (paraphrased) Where the workbook treats it Evidence Coverage
P-1 Risk Management Roles Key roles identified and assigned Book 14, Ch 10 (each role, who must be a government official, the responsibility matrix); the Who chapters of Books 01, 02, 03, 10, 12 and 13; Book 16, Ch 03 trains the roles Responsibility matrices (design guidance); PM-2, PM-10, PM-29 appointments are the agency’s Covered
P-2 Risk Management Strategy Strategy and risk tolerance Book 14, Ch 05 explains PM-9; Book 14, Appendix G, Template 1 gives the outline and a tolerance table Template and Copilot prompt. The strategy, the tolerance values and the approval are the Head of Agency’s Partial by design
P-3 Risk Assessment—Organization Organization-wide risk assessment Book 00, Appendix A gives the program’s risk register as an RA-3 input The program risk register. It’s a program’s risks, not the agency’s organization-wide assessment Partial
P-4 Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (optional in SP 800-37 Rev. 2) Tailored baselines or CSF Profiles Book 14, Ch 01 (SP 800-53B moderate baseline, 287 controls and enhancements in release 5.2.0) and Ch 03; Book 14, Appendix A; Book 00, Ch 02 maps the CSF Functions to the books The control crosswalk and its generated slice. No CSF Organizational Profile, which sits in a task NIST makes optional Partial
P-5 Common Control Identification Common controls published for inheritance Book 14, Ch 10 (common control providers; P-5 in the matrix); Book 12, Ch 10; Book 13, Ch 11 (one package for a shared service) Common control provider plans and assessment results, passed to inheriting system owners Covered
P-6 Impact-Level Prioritization (optional in SP 800-37 Rev. 2) Systems with the same impact level prioritized Book 14, Appendix G, Template 3 (a scoring worksheet that labels NIST-named factors apart from design guidance) Worksheet and Copilot prompt, with weights and cut-offs blank. Whether to run the task, and the factors, weights and cut-offs, are the agency’s Partial by design
P-7 Continuous Monitoring Strategy—Organization Organization-wide ISCM strategy Book 14, Ch 05 (PM-6, PM-31); Book 13, Ch 12 (the monitoring program as a chartered project) The program’s charter, cadence and metric set (design guidance) Covered
P-8 Mission or Business Focus Missions and processes the system supports Book 14, Ch 05 (PM-11); Book 18, Ch 02 (portfolio triage) Evidence maps: examples/evidence-maps rank master records by what depends on them Partial
P-9 System Stakeholders Stakeholders identified Book 14, Ch 10 (the roles and the responsibility matrix); Book 00, Ch 07 (mentions stakeholder sign-off at a gate, but doesn’t identify a system’s stakeholders); the Who chapters above Charter and responsibility matrices Partial
P-10 Asset Identification Assets that need protection Book 14, Ch 05 (the CM-8 component inventory, kept against the PM-5 list of systems); Book 02, Ch 07 and Ch 08; Book 06, Ch 04 (the database estate inventory, including which databases hold PII); Book 05, Ch 10 (device inventory reconciliation) Kit runs with manifests: the Start Kit forest assessment, the non-person identity register, the privileged access inventory Covered
P-11 Authorization Boundary Boundary determined Book 10, especially Ch 11 (the boundary as one artifact); Book 13, Ch 12 (boundaries as governed objects) The boundary record in the package Covered
P-12 Information Types Information types identified Book 14, Appendix F, Step 2 (SP 800-60 Vol. II types with section IDs and a basis for each, for one invented system); Book 14, Ch 01 quotes A-130’s requirement to categorize under FIPS 199 and SP 800-60; Book 12, Ch 09 classifies data Template table 2 and data classification labels. The type list for a real system is the agency’s Partial by design
P-13 Information Life Cycle Life cycle of each information type Book 14, Ch 08 (the PII data-flow map); Book 18, Ch 06 (records from design to decommissioning) The PII data-flow register (template) Partial
P-14 Risk Assessment—System System-level risk assessment Book 00, Appendix A explains RA-3 and gives the program register as an input; Book 14, Appendix G, Template 2 gives an outline built on the SP 800-30 tasks Outline, register-to-risk-row mapping, risk-row table and Copilot prompt. The assessment itself is the system owner’s Partial by design
P-15 Requirements Definition Security and privacy requirements defined The requirements-mapping appendices, for example Book 13, Appendix A, Book 11, Appendix A, Book 12, Appendix A and Book 17, Appendix A; Book 14, Ch 03 Requirement rows, each tied to a control and an evidence item Covered
P-16 Enterprise Architecture Placement in the EA Book 14, Ch 05 (PM-7); Book 18, Ch 09 Baseline, target and transition plan per A-130 §5.a(2) Covered
P-17 Requirements Allocation Requirements allocated to system and environment Book 14, Ch 01 (provider versus agency) and Ch 03 Crosswalk rows marked provider, agency or shared Partial
P-18 System Registration System registered Book 14, Ch 05 (PM-5 system inventory); Book 17, Ch 10 (registration for an AI system, in identity form) Inventory entry; registration itself is an agency process Partial

Step 2 — Categorize

The workbook assumes a moderate system and says why, and Book 14, Appendix F then does the process once: one invented system, walked from its SP 800-60 information types to a FIPS 199 high-water mark and an approval record, with a fill-in template and a Copilot prompt. It’s an illustration. The example’s adjustments are invented, two of its type mappings are judgments the appendix flags for confirmation, and a real categorization stays the agency’s, so all three tasks stop at Partial by design.

Task NIST outcome (paraphrased) Where the workbook treats it Evidence Coverage
C-1 System Description System characteristics documented Book 14, Appendix F, Step 1 (worked fields for the invented system); Book 10, Ch 11 (the system description and boundary rows of the package) Template table 1; the boundary record. The description and the boundary of a real system are the agency’s Partial by design
C-2 Security Categorization FIPS 199 categorization, using SP 800-60 for information types Book 14, Appendix F, Steps 3 to 6 (provisional levels, adjustments, high-water mark, the record); Book 14, Ch 01 (FIPS 199, FIPS 200’s high-water mark, A-130’s rule that PII systems are generally moderate or high for confidentiality); Book 16, Ch 03 teaches it Template tables 3 and 4 and a Copilot prompt. The example’s adjustments are illustrations; the levels for a real system are the owner’s. SP 800-60 Rev. 1 (August 2008) is the current final7 Partial by design
C-3 Security Categorization Review and Approval Categorization approved by the AO or designated representative Book 14, Appendix F, Step 7 (the privacy official’s review, then the AO’s) and what stays the agency’s decision; Book 14, Ch 01 (RA-2 requires the AO’s approval) Template table 5, an approval record to fill in. The approval itself is the agency’s Partial by design

Step 3 — Select

Selection is where the workbook is deepest after authorization. Every book ends in a requirements mapping, and Book 14 says who owns each part of a control.

Task NIST outcome (paraphrased) Where the workbook treats it Evidence Coverage
S-1 Control Selection Baseline selected Book 14, Ch 01 and Ch 03 The control crosswalk (Book 14, Appendix A) Covered
S-2 Control Tailoring Tailored controls, with the rationale Book 14, Ch 01 (tailoring under SP 800-53B and SP 800-37); Book 14, Ch 06 and Ch 09 explain which organization-defined parameters NIST and FedRAMP leave to the agency and where the agency should source the values; compensating controls in Book 13, Ch 12 No single tailored baseline with every organization-defined parameter value Partial
S-3 Control Allocation Common, hybrid and system-specific controls allocated Book 14, Ch 10 (inherited controls aren’t reassessed at system level; the assessor assesses only the system’s part of a hybrid control); Book 14, Ch 01; Book 13, Ch 11 Inheritance recorded in the SSP and the crosswalk Covered
S-4 Documentation of Planned Control Implementations Security and privacy plans with implementation statements Book 10, Ch 11 (writing control narratives at the boundary; the method); Book 14, Ch 11 (the OSCAL SSP model). The requirements-mapping appendices of Books 06, 08, 09, 11, 12, 13 and 17 map controls to chapters and evidence for an agency to reuse in its own plan; each says implementation statements belong to the agency, so they aren’t implementation statements Control-to-evidence mappings and the narrative method. The implementation statements themselves are the agency’s, which is why the mark is Partial. Generation is not covered: no kit generates an SSP, in OSCAL or otherwise Partial
S-5 Continuous Monitoring Strategy—System System monitoring strategy Book 14, Ch 11 (the cadence and freshness limits, design guidance); Book 12, Ch 12 The cadence table and metric set Covered
S-6 Plan Review and Approval Plans approved by the AO or designated representative Book 14, Ch 11 Approval record (agency) Partial

Step 4 — Implement

Implementation is what most of the workbook is. The RMF question for an assessor is narrower: is there a record of what was actually built, and does it match the plan?

Task NIST outcome (paraphrased) Where the workbook treats it Evidence Coverage
I-1 Control Implementation Controls in place The technical books: identity (02, 03, 04), devices (05), data (06), PKI (07), DDI (08), network (09), boundary (10), zero trust (11), security operations (12), day two (15), AI identity (17), applications (18) Configuration exports and kit runs, each with a manifest Covered
I-2 Update Control Implementation Information As-implemented state documented Book 13, Ch 04 (provenance for every state change); Book 04, Ch 10 (access as code); Book 13, Ch 10 The repository history; the Ticket-to-Machine kit’s chained evidence record per scripted step (examples/servicenow-sailpoint) Covered

Step 5 — Assess

Task NIST outcome (paraphrased) Where the workbook treats it Evidence Coverage
A-1 Assessor Selection Assessor with the needed independence Book 14, Ch 11 (CA-2(1) independence; a self-assessment isn’t the independent assessment); Book 14, Ch 10 (the assessor; the CISO doesn’t assess the CISO’s common controls) Assessor designation (agency) Covered
A-2 Assessment Plan (SAP) SAP developed, reviewed and approved Book 14, Ch 11 (what CA-2 requires; the test plan catalog; the OSCAL Assessment Plan model); Book 14, Appendix C (what NIST asks, the template, a Copilot prompt) Plan template and the test plan catalog, each plan with a pass signal (design guidance). The plan is the assessor’s and the approval the AO’s. No kit writes an OSCAL Assessment Plan Partial by design
A-3 Control Assessments Controls assessed Book 11, Ch 09 and Ch 10 (configuration assessment with ScubaGear and the Zero Trust Assessment); Book 13, Ch 07 (what an assessor can verify) Validation kit runs: each check’s mode, every query, the time, the permissions, and a manifest. These are self-assessment evidence the assessor weighs, not the assessment Partial
A-4 Assessment Reports (SAR) SAR with findings and recommendations Book 14, Ch 11 (what the results must state, the OSCAL Assessment Results model); Book 14, Appendix D (what NIST asks, the template, a Copilot prompt); Book 19, Ch 09 (lab step 10) Report template. The drift pipeline’s oscal_export.py writes OSCAL 1.2.3 Assessment Results from an evidence package (fixtures, schema-validated). That’s kit output in OSCAL form, not the report: the findings are the assessor’s Partial by design
A-5 Remediation Actions Initial remediation and reassessment Book 14, Ch 04 (a control closes only with its proof); Book 12, Ch 12 Re-test evidence; the drift pipeline’s comparison of a run with the last Covered
A-6 Plan of Action and Milestones POA&M Book 14, Ch 11 (A-6’s contents, the three dispositions, OSCAL risk status) and Ch 05 (PM-4); Book 11, Ch 10 (from findings to POA&M); Book 19, Ch 09 (lab step 10) The drift pipeline’s oscal_export.py writes an OSCAL 1.2.3 POA&M with dispositions and risk status (fixtures, schema-validated), reading acceptances from a register it doesn’t decide; illustrative POA&M code in Book 14, Ch 11 Covered

Step 6 — Authorize

Task NIST outcome (paraphrased) Where the workbook treats it Evidence Coverage
R-1 Authorization Package Package assembled and submitted Book 14, Ch 11; Book 10, Ch 11; Book 17, Ch 10 (AI in the package) SSP, SAP, SAR, POA&M and executive summary. The drift pipeline’s package (EVIDENCE-MANIFEST.json, SHA256SUMS) is an evidence bundle for the ISSO, not an authorization package Covered
R-2 Risk Analysis and Determination Risk determination Book 14, Ch 11 (the AO’s checklist); Book 13, Ch 09 The determination is the AO’s Partial
R-3 Risk Response Course of action for each risk Book 13, Ch 09 (who accepts exceptions); Book 13, Ch 12 (configuration, compensating control or acceptance) Governed exceptions with an acceptance reference and an end or review date (design guidance) Covered
R-4 Authorization Decision Decision, with terms, a termination date or a review frequency; risk acceptance, which can’t be delegated Book 14, Ch 11; Book 13, Ch 09 The signed decision (agency). Everything the program automates stops short of it Covered
R-5 Authorization Reporting Decision and significant deficiencies reported Book 14, Ch 11 and Book 13, Ch 11 (notifying FedRAMP after authorizing use of a certified service); Book 14, Ch 05 (PM-5 lists each boundary’s authorizing official and authorization status, which partly covers NIST’s annotation of authorization status in the system registry) The notice with the authorization letter. NIST says reporting the decision to agency officials is needed only where authorization functions are delegated below the head of agency; that delegated-AO report isn’t described Partial

Step 7 — Monitor

Task NIST outcome (paraphrased) Where the workbook treats it Evidence Coverage
M-1 System and Environment Changes Changes monitored; significant-change analysis Book 14, Appendix E (the CM-4 analysis, who does it, and a significant-change decision path, design guidance); Book 10, Ch 11 (provider change notices under FedRAMP’s Significant Change Notification rules; the AO decides whether a change is significant, using SP 800-37’s definition); Book 13, Ch 09 (significant change goes to the AO’s designated representative); Book 13, Ch 04 (five change classes) Drift reports from the drift pipeline (drift-report.json, drift-summary.md); provider notice review records; a completed impact analysis from the Appendix E template, with its Copilot prompt. Significance criteria are the agency’s to set Covered
M-2 Ongoing Assessments Control effectiveness assessed on the ISCM schedule Book 12, Ch 12; Book 14, Ch 11 Scheduled validation kit runs; the HR lifecycle package (hr_evidence.py); the non-person identity drift run (Invoke-NpiDriftRun.ps1); the privileged access evidence run (Invoke-PaEvidenceRun.ps1) Covered
M-3 Ongoing Risk Response Findings analyzed and responded to Book 14, Ch 11 (actionable drift, governed exception, lapsed acceptance) Dispositions on each finding (design guidance) Covered
M-4 Authorization Package Updates Plans, reports and POA&M updated Book 14, Ch 11 (monthly regeneration, design guidance); Book 10, Ch 11; Book 19, Ch 09 (lab step 10) Assessment Results and POA&M, which oscal_export.py regenerates from each evidence package (fixtures, schema-validated; a separate command, not a step in the pipeline’s workflow). The plans aren’t regenerated: no kit writes an SSP or an Assessment Plan Partial
M-5 Security and Privacy Reporting Posture reported to the AO and officials Book 12, Ch 12; Book 13, Ch 09 (cadence) Monthly posture report to the AO (design guidance) Covered
M-6 Ongoing Authorization Risk reviewed at agreed frequencies; ongoing authorization Book 14, Ch 11 (A-130’s direction to transition; SP 800-37’s conditions for removing the termination date); Book 13, Ch 01 (authorizations run for periods the agency sets); Book 14, Ch 11 states plainly that no federal rule sets a three-year authorization The review record at each frequency Covered
M-7 System Disposal Disposal strategy executed Book 00, Ch 10 (records before hardware: the decommissioning checklist); Book 07, Ch 08; Book 17, Ch 10 (disposal for an AI system: the identities are gone before disposal is complete); Book 18, Ch 02 (the decommissioning checklist for a retired application) Decommissioning checklist with records disposition Covered

What the kits produce, and what they don’t

The kits are where the workbook’s evidence is real output rather than description. They line up with the RMF like this:

Kit What it writes RMF tasks it supports
Start Kit Forest, attribute and wave inventories P-10 (and inventory input to P-11)
Evidence maps A dependency map with a generated summary; outside exchanges and their agreement terms P-8 (partly: the link rests on dependency ranking, not on mission content)
Validation kit Check results with the evidence behind each, and ValidationManifest.json A-3, M-2
Drift pipeline drift-report.json, drift-summary.md, draft findings, an evidence package with EVIDENCE-MANIFEST.json and SHA256SUMS, and from that package OSCAL assessment-results.json and poam.json A-4, A-5, A-6, M-1, M-2, M-4
Privileged access Privileged inventory with tiers and findings; emergency access checks P-10, A-3, M-2
Non-person identity The register, ownership findings, least-privilege checks, drift against an approved baseline P-10, A-3, M-2
HR lifecycle Lifecycle runs, packaged by the drift pipeline’s hr_evidence.py A-3, M-2
Ticket-to-Machine Closed findings as evidence records with a hash chain; a chained record per scripted step I-2, A-5

OSCAL: two models of four. The drift pipeline’s oscal_export.py turns an evidence package into OSCAL 1.2.3 Assessment Results and a POA&M, both validated against NIST’s published schemas, and lab step 10 runs it. It’s tested against fixtures only. No assessor’s tooling has accepted its output, its check-to-control map is a draft to review, and it reads dispositions from an acceptance register without deciding any. No kit writes an OSCAL system security plan or assessment plan, so the import-ssp and import-ap links in the output point at files the agency supplies. Book 14, Chapter 11 describes all four models; producing those two is still the agency’s work, or its governance tool’s.

Not covered, in one list

No task is marked Not covered. What the workbook still lacks falls into three groups.

Missing artifacts the workbook could add:

  • OSCAL system security plan and assessment plan generation (S-4, A-2, M-4). The drift pipeline writes Assessment Results and a POA&M; nothing writes the other two, and the plans aren’t regenerated.
  • A single tailored baseline with every organization-defined parameter value (S-2).
  • A CSF Organizational Profile (P-4, a task NIST makes optional). The books map the CSF Functions, not a Profile.
  • Internal reporting of the authorization decision (R-5) beyond the FedRAMP notice.

Stops at a template by design. The workbook gives the method and a Copilot prompt; the content is the agency’s:

  • The risk management strategy and risk tolerance (P-2), impact-level prioritization, which NIST makes optional (P-6), and the system-level risk assessment (P-14): Book 14, Appendix G.
  • The information types, system description, categorization and approval of a real system (P-12, C-1, C-2, C-3): Book 14, Appendix F.
  • The assessment plan and the assessment report (A-2, A-4): Book 14, Appendix C and Appendix D.

Partial for other reasons:

  • Agency-level records the program’s artifacts only feed: the organization-wide risk assessment (P-3), the mission analysis (P-8), the full stakeholder list (P-9), the life cycle of each information type (P-13), requirements allocation beyond provider, agency or shared (P-17), and system registration (P-18).
  • Decisions with no template: plan approval (S-6) and the risk determination (R-2).
  • The independent assessment (A-3). Kit runs are self-assessment evidence the assessor weighs.

Status and review

In review. The task names and step purposes were read at csrc.nist.gov on November 2, 2026; every coverage mark comes from reading the chapter it links. On November 6, 2026 the page was updated for the templates and the OSCAL converter merged that day: nine marks changed (P-2, P-6, P-12, P-14, C-1, C-2, C-3, A-2 and A-4 became Partial by design) from reading Book 14 Appendices C to G and the converter, and the tally moved from 25 Covered, 21 Partial, 1 Not covered to the 47-task figures above. A-6, M-1 and M-4 keep their marks with new evidence. M-1 stays Covered because the drift pipeline monitors change and Appendix E now supplies what its row lacked. The other 35 marks weren’t re-read in that pass. Every link and anchor resolves (scripts/check_rmf_map.py --check).

On November 8, 2026 an independent review sampled 36 marks and found 31 holding. S-4 moved from Covered to Partial, because the requirements-mapping appendices leave implementation statements to the agency; the tally is now 24 Covered, 14 Partial, 9 Partial by design, 0 Not covered, and the crosswalk’s RMF scores for Books 08 and 09 dropped from 3 to 2. The S-2 row, the Appendix E citation, P-4’s optional status, the crosswalk relationship and several pointers were corrected. The page remains in review.

The page stays in review. To move it to Proved, a reviewer who didn’t write these marks confirms them against the books, including:

  • the 35 marks not re-read on November 6. On November 7 the 57 cited pages that changed since then (the Book 14 corrections, the open choices and the inconsistency fixes) were re-read for what each mark relies on; two pointers were corrected (P-10, R-3) and no mark moved. A reviewer who didn’t write the marks still has to confirm all of them. Book 14 Appendix A has no PM-18 or PM-19 rows and still lists PM-7 as open; neither changes a mark here;
  • whether A-1 and R-4 stay Covered though their outcomes are agency decisions, while C-3 is Partial by design, and whether M-1 should stay Covered. The independent review of November 8, 2026 observed that the scoring rule is applied unevenly: S-6 and R-2 are Partial for the same reason that A-1 and R-4 are Covered, and a template task such as C-3 ranks below a task with prose only. It left the choice of one rule open, and this page hasn’t made it;
  • Appendix D’s kit table, which now names the converter’s Assessment Results and POA&M output; a reviewer confirms the wording matches A-4 and M-4;
  • the points the appendices leave open: SP 800-30 Appendix K against the Template 2 layout, the task Appendix G names as P-6’s precondition, and the two SP 800-60 type mappings Appendix F flags.

Corrections are welcome as issues on GitHub.

Back to top

Footnotes

  1. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018, Chapter 3 (§3.1 Prepare, §3.2 Categorize, §3.3 Select, §3.4 Implement, §3.5 Assess, §3.6 Authorize, §3.7 Monitor; Tasks P-1 to M-7), Appendix E (task summary table with short task names) and Appendix F (ongoing authorization; event-driven triggers and significant changes), https://csrc.nist.gov/pubs/sp/800/37/r2/final; PDF https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Nov 2, 2026). The publication page lists no newer revision.↩︎

  2. 44 U.S.C. §3554 (2023 edition), Federal agency responsibilities, (a)(1), (a)(3) and (b), https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap35-subchapII-sec3554.htm (accessed Nov 2, 2026).↩︎

  3. National Institute of Standards and Technology, FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004, https://csrc.nist.gov/pubs/fips/199/final (accessed Nov 2, 2026).↩︎

  4. National Institute of Standards and Technology, FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006, https://csrc.nist.gov/pubs/fips/200/final (accessed Nov 2, 2026).↩︎

  5. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018, Chapter 3 (§3.1 Prepare, §3.2 Categorize, §3.3 Select, §3.4 Implement, §3.5 Assess, §3.6 Authorize, §3.7 Monitor; Tasks P-1 to M-7), Appendix E (task summary table with short task names) and Appendix F (ongoing authorization; event-driven triggers and significant changes), https://csrc.nist.gov/pubs/sp/800/37/r2/final; PDF https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Nov 2, 2026). The publication page lists no newer revision.↩︎

  6. National Institute of Standards and Technology, Computer Security Resource Center, “About the RMF” (step names and purposes), https://csrc.nist.gov/projects/risk-management/about-rmf (accessed Nov 2, 2026).↩︎

  7. National Institute of Standards and Technology, SP 800-60 Vol. 1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008, https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final (accessed Nov 2, 2026); and SP 800-60 Vol. 2 Rev. 1, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008, https://csrc.nist.gov/pubs/sp/800/60/v2/r1/final, the source of the information types in P-12 and Appendix F. OMB Circular A-130, Appendix I §4.a, requires categorization “in accordance with FIPS Publication 199 and NIST SP 800-60,” https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf (accessed Nov 2, 2026).↩︎