-: Now let's take a look 2 2
at all the resources that are provided 3 3
in Special Publication 800-37 4 4
for each step in the risk management framework. 5 5
Each of the seven steps in RMF has a purpose statement, 6 6
a defined set of outcomes, 7 7
and a set of tasks 8 8
that are carried out to achieve those outcomes. 9 9
For example, 10 10
the first outcome in the prepare step for your organization 11 11
comes from doing Task P-1, and it says, 12 12
individuals are identified and assigned key roles 13 13
for executing the risk management framework. 14 14
By the way, 15 15
RMF outcomes for Task P-1 map to two specific outcomes 16 16
in the NIST Cybersecurity Framework. 17 17
The first is ID.AM-6, 18 18
which says, 19 19
cybersecurity roles and responsibilities 20 20
for the entire workforce and third-party stakeholders 21 21
are established. 22 22
And the second cybersecurity framework outcome 23 23
that maps to Task P-1 is ID.GV-2, 24 24
which says, 25 25
cybersecurity roles and responsibilities 26 26
are coordinated and aligned 27 27
with internal roles and external partners. 28 28
We'll take a much closer look at the relationship 29 29
between RMF and the cybersecurity framework 30 30
in a future lesson. 31 31
But for now, just know that there is 32 32
a complimentary and useful relationship 33 33
between these two frameworks. 34 34
Okay, let's go back to RMF. 35 35
To prepare your organization 36 36
for the RMF work you'll need to do, 37 37
you'll need to complete seven tasks, 38 38
numbered P-1 through P-7. 39 39
And you can see what I'm talking about 40 40
by looking at Table 1 on page 28 41 41
of Special Publication 800-37. 42 42
Now throughout the RMF publication, 43 43
each task contains a lot of helpful resources. 44 44
Looking at the top of page 29, 45 45
you'll see the five types of resources 46 46
provided for you to complete Task P-1. 47 47
First, 48 48
there's a set of potential inputs needed 49 49
to complete the task. 50 50
And then, you'll see a description of the outputs 51 51
you'll have from completing the task. 52 52
In addition, you'll find two lists 53 53
of the primary and secondary roles 54 54
that have responsibility for this task. 55 55
For example, 56 56
Task P-1 shows that the head of agency 57 57
is a role with primary responsibility. 58 58
Then there's a discussion section 59 59
and that provides you with detailed information 60 60
to help you plan out 61 61
how you're going to complete the task. 62 62
And finally, there's a list of references, 63 63
which often link to other NIST documents 64 64
that can provide you with more details 65 65
about different aspects of the task. 66 66
As you read through the Task P-1 description on page 29, 67 67
you'll see the many resources provided 68 68
to help you complete this task. 69 69
A lot of the resources are found in later pages 70 70
of Special Publication 800-37. 71 71
Some of the resources are contained 72 72
in other NIST publications 73 73
and some can only come from your organization. 74 74
Now, don't be afraid to draw on other resources 75 75
if you need to. 76 76
What you'll find in RMF is just a starting point.