Welcome, Step 0

By Lon J. Berman, CISSP, RDRP Q. The Risk Management Framework (RMF) life cycle is comprised of how many steps? A. Oh, that’s easy, it’s six. Well … not so fast. As you probably know, the Risk Management Framework (RMF) has always been described as a six step process, to…

Continue Reading

Post Categories: Risk Management Framework Tags:

Security Control Spotlight: AC-20 (Use of External Information Systems)

By Ernest Smith, CISSP, PMP Requirement (simplified): Do you have contracts and or service level agreements with the owners of any system outside of your authorization boundary that are processing, storing, and transmitting your information? Breakdown: What is an “external information system”? Employee personally owned devices (I said it!) Systems…

Continue Reading

Post Categories: Risk Management Framework Tags:  CONTROLS NIST SP 800-53 RMF

Happy Birthday, RMF!

By Lon J. Berman, CISSP, RDRP This month we will be celebrating our oldest grandson’s tenth birthday. It suddenly made me realize that with everything that’s been going on in 2020, it appears we missed another significant birthday this year – February marked the tenth birthday of the Risk Management…

Continue Reading

Post Categories: Risk Management Framework Tags:

RMF and eMASS in the National Industrial Security Program (NISP)

By Lon J. Berman, CISSP, RDRP Organizations performing classified work for DoD (aka. Cleared Contractor Facilities) are governed by the National Industrial Security Program (NISP). NISP is administered by the Defense Counterintelligence and Security Agency (DCSA), formerly known as the Defense Security Service (DSS). In general, companies covered by NISP…

Continue Reading

Post Categories: NISPRisk Management Framework Tags:

Ask Dr. RMF

Dear Dr. RMF, RMF IA-4 Identification Management control is not easy.  It has so many rabbit holes.  I am not sure how to tackle this control.  Could you please simplify this control for me.  Let’s say for IA-4 Identifier Management, the information system is a web application/web server.  For the…

Continue Reading

Post Categories: Dr. RMFRisk Management Framework Tags: