-: The purpose of the prepare step 2 2
is to make sure your organization is ready 3 3
to manage its cyber supply chain and privacy risks 4 4
using the Risk Management Framework. 5 5
There are two collections of tasks within the prepare step, 6 6
organizational level tasks, and system level tasks. 7 7
Altogether, this step has 18 tasks 8 8
which is much more than any other single step in RMF. 9 9
If you want to see a summary of all the tasks 10 10
from each of the seven RMF steps, 11 11
check out appendix E in special publication 800-37 12 12
which starts on page 126. 13 13
In this lesson, we're going to look at tasks 14 14
that prepare your organization for RMF. 15 15
In the next lesson, we'll look at the tasks 16 16
that prepare your system for RMF. 17 17
We said that RMF is a framework 18 18
and that organizations have discretion over which tasks 19 19
and how rigorous they're going to be 20 20
when assembling a RMF approval package. 21 21
But to be clear, you have to do all seven steps 22 22
and you have to carefully consider how to do each task 23 23
within each step, and you have to put a reasonable amount 24 24
of effort into each of those tasks 25 25
based on whether your system or data is categorized as high, 26 26
medium, or low. 27 27
There are seven tasks in the prepare step 28 28
at the organizational level. 29 29
Let's go through each one right now so you can know 30 30
what needs to be done. 31 31
When you finish Task P-1, 32 32
individual people will be identified and assigned key roles 33 33
for moving an ATO request 34 34
through the Risk Management Framework. 35 35
This list of people and their roles is the specific outcome 36 36
of this task. 37 37
The standard roles and responsibilities of key participants 38 38
in RMF are described in appendix D. 39 39
It's important that you make sure there are no conflicts 40 40
of interest when assigning the same individual 41 41
to multiple roles. 42 42
For example, authorizing officials cannot occupy 43 43
the role of system owner. 44 44
Now, when you finish task P-2, 45 45
you'll have a risk management strategy 46 46
for your organization that includes a determination 47 47
and expression of organizational risk tolerance. 48 48
Now, risk tolerance is the degree of risk 49 49
or uncertainty that is acceptable to your organization 50 50
and it's supposed to help people make risk decisions 51 51
based on the needs of the mission, 52 52
rather than on their own personal sense 53 53
of how much risk is okay. 54 54
Your risk management strategy 55 55
should also include a brief description 56 56
of your acceptable risk assessment methodologies 57 57
and your risk response strategies. 58 58
You also need to include a process 59 59
for consistently evaluating security and privacy risks 60 60
organization wide, and you need to talk about approaches 61 61
for monitoring risk over time. 62 62
Now, the result of task P-3 will be an organization-wide 63 63
risk assessment if you don't already have one, 64 64
or you may be able to update an existing risk assessment. 65 65
The breadth of your organizational risk assessment 66 66
is very wide. 67 67
You'll need to pull together all system level 68 68
risk assessment results. 69 69
You'll need insights on risk from continuous monitoring 70 70
and you'll need any strategic risk considerations 71 71
that are relevant to your organization, 72 72
like your current missions and operating locations. 73 73
And don't forget to include risks from information exchanges 74 74
and network connections that you have 75 75
with other internally and externally owned systems 76 76
and from the use of external providers. 77 77
Now, task P-4 is the first explicitly optional task 78 78
that you'll encounter in RMF. 79 79
The opportunity here is to formally incorporate 80 80
the NIST Cybersecurity Framework into your organization, 81 81
and you'll do this by tailoring, 82 82
or what's also known as profiling the CSF 83 83
to fit your organization's unique needs. 84 84
Now, this can help you later on when you select controls 85 85
for the specific ATO that you're working on 86 86
because your CSF profile will guide you to specific areas 87 87
that are already prioritized and specified for your system. 88 88
Hopefully, this task has already been accomplished 89 89
since it doesn't need to be unique to each ATO 90 90
that you're working on. 91 91
In a similar way, the result of task P-5 is a published list 92 92
of the common controls that are available for use 93 93
by your organizational systems. 94 94
There's no need to recreate this list 95 95
for each ATO that you're working on, 96 96
so I hope you'll simply be able to look up the list 97 97
that your organization already has. 98 98
Now, a simple example of a common control 99 99
might be a centralized endpoint detection 100 100
and response solution, 101 101
probably from a commercial off the shelf source. 102 102
If your organization already has an EDR package, 103 103
then your system may be able to use it 104 104
which will eliminate the need for you to search for an EDR 105 105
to purchase just for your system. 106 106
Task P-6 is another optional one 107 107
and is done only after organizational systems 108 108
have been categorized in task C-2, 109 109
which is in the categorized step. 110 110
Talk with your senior accountable official 111 111
for risk management to find out if you should do this step 112 112
for your ATO request. 113 113
If you do this task, then you'll need to become familiar 114 114
with the FIPS 199 and FIPS 200 standards, 115 115
both of which are published by NIST. 116 116
By the way, FIPS, F-I-P-S, 117 117
means Federal Information Processing Standards 118 118
and each standard focuses on one specific topic. 119 119
The final task in this step one collection is P-7. 120 120
The output is a developed and implemented 121 121
organization-wide strategy 122 122
for monitoring control effectiveness. 123 123
Hopefully, this task has already been accomplished 124 124
since it probably won't need to be unique to each ATO 125 125
you're working on. 126 126
In the next video, we'll cover the 11 tasks 127 127
you need to complete in order to prepare your system 128 128
for RMF, and after that one, 129 129
we'll have a video that explores the practical aspects 130 130
of doing all 18 tasks in the prepare step.