NIST RISK MANAGEMENT FRAMEWORK

Identify 
Select 
Review 
Finalize 

Assign System

Information
Provisional
Provisional
Information

Security Category
Types Impact Levels Impact Levels Impact Levels

NIST SP 800-60

TASK C-1 
TASK C-2 
TASK C-3 Security
System Description Security Categorization Categorization Review & Approval

AUTHORITY DOCUMENTS
Preventive
Document
Manual
System
Review System

System
Detective NIST SP 800-53 CIS CSC 20
Categorization Categorization
Characteristics
Automatic NIST SP 800-53b PCI DSS
Systems Categorized
Deterrent
CONTROL

Systems NIST CSF

MATRIX ISO 27002
Corrective Physical
ISO 27001 ISO 27018
Compensating Technical
TASK M-1 System and TASK M-2 
TASK M-3 Ongoing TASK M-4 Authorization TASK M-5 Security TASK M-6
COBIT 2019 ISO 27701
Recovery Administrative
Environment Changes Ongoing Assessments Risk Response Package Updates and Privacy Reporting Ongoing Authorization

Update
Report
System

Monitor Systems Risk Assessment Risk Treatment

Documentation System Status Authorization Baseline
Approach
CATEGORIZE
TASK S-5 Continous
SYSTEMS
Monitoring Strategy
TASK M-7

System Disposal

MONITOR
SELECT
Allocate Controls to Document Control Review Security &
Select Controls
Tailor Controls
CONTROLS
CONTROLS
Systems and Assets Implementations Privacy Plans
System Disposal
Security &
Approved

TASK S-1 
TASK S-2 
TASK S-3
TASK S-4 Documentation of Privacy Plans TASK S-6 Plan
Security &

PREPARE Control Selection Control Tailoring Control Allocation

planned control implementation Review and Approval Privacy Plans

AUTHORIZE
IMPLEMENT

SYSTEMS
CONTROLS

TASK R-1
TASK R-2 Risk Analysis TASK R-3
TASK R-4

Authorization Package and Determination Risk Response Authorization Decision

Security &
Executive
ASSESS

Privacy Plans Summary CONTROLS

TASK I-1 Control TASK I-2 Update Control
Assemble

System
Implementation Implementation Information
Authorization
Risk Assessment Risk Treatment
 Authorization
Package

Implement
Document

Security &
Plan of
Controls Changes
Privacy
Action &
Report

Assessment Milestones Authorization Approved

Updated

Security &
Security &

Privacy Plans Privacy Plans

NIST SP 800-53a
TASK R-5

Authorization Reporting
PRE-ASSESSMENT ASSESSMENT POST-ASSESSMENT

Prepare for Security Develop Security

Conduct Security
Analyze

and Privacy
 and Privacy
 and Privacy Assessment

 Control Assessments  Assessment Plans  Assessments Reports Prepare

Prepare Systems
Organization
TASK A-1
TASK A-2
TASK A-3
TASK A-5

Assessor Selection Assessment Plan Control Assessments

Remediate Actions

TASK P-1 Risk TASK P-8 Risk TASK P-15 Risk

TASK A-4
TASK A-5 Plan of Management Roles Management Roles Management Roles
Assessment Reports
Action and Milestones

TASK P-2 Risk TASK P-9 Risk TASK P-16 Risk

Management Strategy Management Strategy Management Strategy

TASK P-3 Risk TASK P-10 Risk TASK P-17 Risk

Assessment Organization Assessment Organization Assessment Organization
Approved
Assessment
Assessment
Remediation
Updated

Security &
Plans Reports Plans Security &
TASK P-4 Controls TASK P-11 Controls TASK P-18 Controls
Privacy Plans Privacy Plans Baselines and Profiles Baselines and Profiles Baselines and Profiles

TASK P-5 Common TASK P-12 Common

Control Identification Control Identification

TASK P-6 Impact TASK P-13 Impact

Level Prioritization Level Prioritization

TASK P-7 Continous TASK P-14 Continous

Monitoring Strategy Monitoring Strategy

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf