====== Risk Management Framework (RMF) ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

The Risk Management Framework (RMF) provides a structured process for managing security, privacy, and related risks for systems and organizations.

The RMF integrates risk-management activities into the system development lifecycle and connects system-level risk decisions with organization-level risk-management responsibilities.

The RMF includes the following activities:

  * Prepare
  * Categorize
  * Select
  * Implement
  * Assess
  * Authorize
  * Monitor

The RMF establishes a repeatable process for:

  * Categorizing systems and information
  * Selecting security and privacy controls
  * Implementing controls
  * Assessing control implementation and effectiveness
  * Making risk-based authorization decisions
  * Monitoring systems, controls, and risks

Within Crucible documentation, the RMF provides the process context for generating, organizing, preserving, and presenting compliance information and supporting [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]].

Crucible does not perform the management responsibilities assigned to system owners, control assessors, risk executives, or [[dido:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authorities]]. Crucible provides artifacts and evidence that those actors use when performing RMF activities.

===== Definition =====

//structured and repeatable process that integrates security, privacy, and risk-management activities into the lifecycle of a system or organization//

===== Source =====

Adapted from National Institute of Standards and Technology Special Publication 800-37 Revision 2, //Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy//.

===== Note =====

The acronym **RMF** means **Risk Management Framework**.

The RMF addresses more than authorization. It includes activities that prepare an organization to manage risk, categorize systems and information, select and implement controls, assess controls, authorize system operation, and monitor the resulting security and privacy posture.

An [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|Authorization to Operate (ATO)]] represents one possible authorization decision produced during the Authorize activity of the RMF.

Evidence generated by Crucible can support the Implement, Assess, Authorize, and Monitor activities without transferring responsibility for those activities to Crucible.

===== Example =====

A system owner uses Crucible-generated configuration records, control implementation descriptions, compliance findings, provenance, and supporting evidence during RMF assessment and authorization activities.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>