SP 800-37 Rev. 2Final2018

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

At a glanceThe seven-step Risk Management Framework that federal agencies use to secure and authorize systems: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. Most districts will not run the full RMF, but its steps are a sound model for launching a major new system. Use SP 1314 for a short introduction.

Reading level: Technical
Length: 183 pages · about 90 min for the key parts
Best for: Technology directors, IT staff and service partners
CSF 2.0: Govern, Identify

Read it on NIST DOI 10.6028/NIST.SP.800-37r2 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The RMF ties system categorization, control selection and implementation, assessment, formal authorization and continuous monitoring into one life cycle, with a Prepare step that sets organization-wide context. Security and privacy are built into system development, and roles are defined clearly.

How it is organized

Chapter 2: fundamentals (organization-wide risk, authorization boundaries, supply chain)
Chapter 3: the steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor)
Appendices: roles, task summary, authorization types, boundaries, life cycle considerations

What a school district should take from it

A formal 'authorization' decision is a useful idea: a named leader accepts the remaining risk of a system before it goes live.
The full RMF is heavy for most districts; borrow the steps, not the paperwork.

How to use it in your district

Before launching a new system that holds student data, walk through Categorize, Select and Assess in a short checklist.
Have a named leader sign off on remaining risk, recorded in the Risk register.
Schedule monitoring tasks for the system in the operations planner.

Common misconceptions

Districts must follow the RMF.: The RMF is required for federal systems. Districts can use its ideas voluntarily unless a contract requires it.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.RMRisk Management Strategy
GV.RRRoles, Responsibilities, and Authorities
ID.RARisk Assessment

Tools in the program portal

Risk registerRecord gaps leadership formally accepts, with controls and review dates
School-year operations plannerSchedule recurring security work across the year
Vendor RegistryKnow which vendors hold district data

Related publications

SP 1314RMF quick start for small organizations
SP 800-53 Rev. 5Security and privacy control catalog
SP 800-30 Rev. 1Conducting risk assessments

Citation and source

SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. National Institute of Standards and Technology. 2018. https://doi.org/10.6028/NIST.SP.800-37r2.

Replaces: SP 800-37 Rev. 1 (2014 update), CSWP 3 (2014).

Topics: Governance and risk, Control catalogs and assessment. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.