This section provides a breakdown of the RMF stages as a reminder of the details we covered in the previous chapter. Utilize this section as a guideline to refer back to as you work through tailoring the RMF to your organization, and learn about how other organizations have implemented the NIST RMF.

Here are the RMF stages:

• Prepare:
  • Scope definition: Establish the RMF’s scope across the organization. This includes what departments will participate in the process, as well as what infrastructure will be evaluated. In some cases, this may not be every network the organization utilizes based on segmentation.
  • Resource identification: Identify necessary resources, including personnel and technology. This can also include planning for the time to conduct the process as well as costs.
  • Risk assessment foundation: Develop a foundational understanding of risk assessment principles.
• Categorize:
  • System and information valuation: Evaluate...