NIST RMF FULLY EXPLAINED (IN PLAIN ENGLISH)

Gerald Dozier kicks off the video by introducing himself and the topic: the NIST Risk Management Framework (RMF). He mentions that the RMF is a GRC function used by federal IT systems and is a structured approach to implementing information security. Despite his personal preference for the NIST Cybersecurity Framework, he acknowledges the RMF's importance, especially in the US government. The video is interactive, with Gerald engaging with the audience through a chat feature, which he initially struggles with but eventually resolves. He also provides a resource by Aaron Lang for further understanding.

Gerald delves into the specifics of the NIST RMF, explaining that it is a six-step process designed to establish proper controls on federal IT systems. He outlines the steps: system categorization, control selection, implementation of controls, control assessment, authorization, and monitoring. He emphasizes the complexity of step three (implementing controls) and the importance of step four (assessing controls), which is typically conducted by an independent auditor. Gerald also discusses the challenges of categorizing systems and the tendency for most systems to be categorized as moderate due to the high costs and efforts associated with high-level security controls.

The discussion shifts to NIST 800-53, a document that provides a comprehensive list of security controls. Gerald explains how to use this document for tailoring controls based on the system's categorization. He highlights the importance of selecting the 'high water mark' when determining the security control baseline. Tailoring controls is presented as an advanced step that allows for the addition or removal of controls based on specific organizational needs. Gerald also shares his experience with the document's complexity and how it has evolved over time.

Gerald focuses on the creation of the System Security Plan (SSP), a critical document in the RMF process. He explains that the SSP is a living document that details how security controls are implemented and managed. The process involves defining policies, procedures, and assigning responsibilities for various controls. Gerald emphasizes the importance of documenting changes and keeping the SSP updated. He also discusses the challenges of getting approval for the SSP and the reality of implementing controls in parallel with creating the SSP.

This section covers the process of assessing security controls, which is a crucial step in the RMF. Gerald explains the pre-assessment, assessment, and post-assessment phases. He stresses the importance of planning, executing, and reporting on the findings of the assessment. Gerald also provides tips on how to effectively communicate with stakeholders and gather necessary information during the assessment process.

Gerald discusses the authorization process, where an authorized official reviews the assessment results and decides whether to accept the risks associated with any controls that are not fully implemented. He mentions the creation of a Plan of Action and Milestones (POAM) to address these risks. Gerald also touches on the ongoing monitoring of controls, emphasizing the need for regular updates and reassessments to ensure continuous compliance and security.

The final part of the RMF process involves system disposal and the repetition of the RMF steps as necessary. Gerald explains that when a system is no longer needed, it should be disposed of properly according to formal procedures. He also notes that the RMF is not a one-time process but should be repeated periodically to ensure that the system remains secure and compliant as its purpose and the environment change over time.

Gerald concludes the video by summarizing the key points of the NIST RMF and expressing his personal views on the framework's effectiveness compared to the NIST Cybersecurity Framework. He invites viewers to join future discussions and briefings, highlighting the importance of continuous learning and adaptation in the field of cybersecurity.