# NIST SP 800-37 **Entity class:** Federal risk-management guidance ## Definition **NIST Special Publication 800-37 Revision 2** defines the federal Risk Management Framework and a system-lifecycle approach for security and privacy. It emphasizes continuous monitoring, ongoing authorization, accountability, and organization-wide risk management. ## Relationships - **defines:** [[wiki/Risk Management Framework|Risk Management Framework]]. - **uses:** [[wiki/NIST SP 800-53|NIST SP 800-53]] controls. - **companion for NSS:** [[wiki/CNSSI 1253|CNSSI 1253]]. - **supports:** [[wiki/Machine-Readable Assurance|Machine-Readable Assurance]]. ## Sources / Provenance - [NIST — SP 800-37 Rev. 2, December 2018](https://csrc.nist.gov/pubs/sp/800/37/r2/final)