NIST releases Risk Management Framework 2.0 to combine privacy, security and supply chain into one

RMF 2.0 includes seven objectives and adds a preparation step.

The National Institute of Standards and Technology posted the newest update to its Risk Management Framework.

“RMF 2.0 is the first framework in the world to address security, privacy, and supply chain risk in an integrated manner — at the organization, mission/business process, and system levels,” NIST Fellow Ron Ross wrote in a Twitter post.

RMF 2.0’s full name is the NIST Special Publication 800-37 Revision 2, Risk Management Framework (RMF) for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

NIST said RMF 2.0 adds a step called Prepare and includes seven major objectives.

Prepare is intended to help organizations facilitate effective communication between executives and employees. It also guides users to enable enterprise-wide identification of privacy and security controls, reduce complexity of IT systems and applications, eliminate unnecessary functions and, ultimately, to prioritize resources for high value assets and protect those accordingly.

NIST listed the seven objectives of the Risk Management Framework.

• Provide closer linkage and communication top executives and governance-level employees and the rest of the organization
• Create critical risk management preparatory activities at all necessary levels
• Show how the NIST Cybersecurity Framework can be aligned with the RMF
• Include privacy risk management in the RMF
• Promote trustworthy secure systems by aligning the RMF with NIST framework for engineering such secure systems
• Integrate supply chain risk management concepts into the RMF
• Enable organizations to generate a “control selection approach” as a complement to NIST SP 800-53 Revision 5 consolidated control catalog.
• “By achieving the above objectives, organizations can simplify RMF execution, employ innovative approaches for managing risk, and increase the level of automation when carrying out specific tasks,” NIST added.