This bulletin summarizes the information presented in NIST Special Publication (SP) 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Developed by NIST in partnership with the Joint Task Force Transformation Initiative, the publication supports federal managers in both defense and civil agencies in making informed decisions about the security of their information systems. The revised guide explains the basic concepts to be applied to the management of security risks to information systems. The bulletin discusses issues emphasized in the publication: planning and building information security capabilities into information systems throughout the system life cycle; implementing up-to-date management, operational, and technical security controls; and maintaining awareness of the security condition of information systems though improved monitoring. The Risk Management Framework is explained, and references are provided to additional sources of information on risk management.
This bulletin summarizes the information presented in NIST Special Publication (SP) 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Developed by NIST in partnership with the Joint Task Force Transformation...
See full abstract
This bulletin summarizes the information presented in NIST Special Publication (SP) 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Developed by NIST in partnership with the Joint Task Force Transformation Initiative, the publication supports federal managers in both defense and civil agencies in making informed decisions about the security of their information systems. The revised guide explains the basic concepts to be applied to the management of security risks to information systems. The bulletin discusses issues emphasized in the publication: planning and building information security capabilities into information systems throughout the system life cycle; implementing up-to-date management, operational, and technical security controls; and maintaining awareness of the security condition of information systems though improved monitoring. The Risk Management Framework is explained, and references are provided to additional sources of information on risk management.
Hide full abstract
Keywords
accreditation; authorization; availability; categorization; certification; confidentiality; FISMA; integrity; information security; information systems security; Joint Task Force; risk management; Risk Management Framework; security controls; security plans; security risks; system development life cycle
