NIST RMF (SP 800-37): The 7 Steps Explained

The 7 Steps (SP 800-37 Rev 2)

After Prepare, later steps can be nonsequential when the organization already has artefacts (Rev 2 flexibility).

How CyberSilo Helps

• Compliance Standards Automation — Select → Implement → Assess evidence continuity
• ThreatHawk SIEM — Monitor step signals and Detect artefacts that feed Assess

Frequently Asked Questions

Is RMF only for federal systems?

It is designed for federal information systems. Contractors often mirror it for FedRAMP and related discipline.

Where do baselines enter?

In the Select step, typically via SP 800-53 and SP 800-53B Low, Moderate, or High baselines.

How does RMF relate to CSF?

RMF is a risk process for systems. CSF is an outcome-oriented Framework. They are complementary, not substitutes.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · ThreatHawk SIEM