-: In this section of the course, we're going to learn more 2 2
about the risk management framework from a higher level 3 3
so that we can get a good overview of the entire process 4 4
before we dive individually into each step in more depth. 5 5
As we move through this section, 6 6
we're going to first take a look at the reasons that RMF exists 7 7
in the first place, what it was designed for, 8 8
and how it's implemented inside of an organization. 9 9
Then we're going to move into a quick overview 10 10
of the seven-step process 11 11
as we move from prepare, to categorize, 12 12
to select, to implement, to assess, to authorize, 13 13
and finally to monitoring our controls for a given system. 14 14
After that, we're going to take a quick look 15 15
at Special Publication 800-37 from NIST, 16 16
which is the heart and soul 17 17
of the Risk Management Framework. 18 18
Next, we're going to discuss the changes 19 19
in the Risk Management Framework, moving from version one 20 20
into the latest version, version two, 21 21
which is going to be the version that we're going to focus on 22 22
during our time together in this course. 23 23
Then we're going to expand our coverage from just risk 24 24
and look at how we can look at information security, privacy 25 25
and risk as all one consolidated and integrated effort 26 26
inside of our Risk Management Framework 27 27
to give us a better and more complete picture 28 28
of our overall risk posture. 29 29
After that, we're going to talk about authorization boundaries 30 30
and how to set up and configure them. 31 31
Authorization boundaries are going to be used 32 32
to define which elements of a given system 33 33
are going to be considered in scope 34 34
for our different assessments 35 35
and which parts are we going to be seeking authorization 36 36
for use in our networks. 37 37
Next, we're going to cover the concepts surrounding 38 38
supply chain risk management, known as SCRM. 39 39
In the latest version of the Risk Management Framework, 40 40
the supply chain has been added because it's critical 41 41
to the underlying security of your networks and systems, 42 42
and therefore it has to be considered 43 43
when you're working through the RMF process. 44 44
Then we're going to look at two very important concepts in RMF, 45 45
requirements and controls. 46 46
Often people will treat requirements and controls 47 47
as being used interchangeably and meaning the same thing, 48 48
but they really are different things 49 49
and they're used for different purposes. 50 50
So we're going to take some time to untangle these two concepts 51 51
and ensure that you understand 52 52
when each one is going to be used inside of RMF. 53 53
After that, we're going to look at the flexibility provided 54 54
by RMF, because it's able to be scaled upward and downwards 55 55
based on the size and scope of your organization 56 56
and its systems. 57 57
Finally, we're going to take a quick look at the timelines 58 58
that are involved when you're going through the RMF process, 59 59
because this can be a really lengthy process 60 60
in a lot of different organizations, 61 61
and it's important to have a good understanding 62 62
of how much time and effort is going to be involved 63 63
before you try to begin pushing a new RMF package 64 64
through that system in order to gain authorization 65 65
for your new system or network. 66 66
So, if you're ready, let's dive into our coverage 67 67
of the Risk Management Framework 68 68
in this section of the course.