# Risk Management Framework **Entity class:** Security-risk lifecycle ## Definition The **Risk Management Framework (RMF)** organizes security and privacy risk management around seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. It treats authorization as accountable risk acceptance within a continuing lifecycle rather than a permanent certification. ## Relationships - **defined in:** [[wiki/NIST SP 800-37|NIST SP 800-37]]. - **selects controls from:** [[wiki/NIST SP 800-53|NIST SP 800-53]]. - **national-security application:** [[wiki/CNSSI 1253|CNSSI 1253]]. - **IC application:** [[wiki/ICD 503|ICD 503]]. - **produces:** [[wiki/Authorization to Operate|Authorization to Operate]] and [[wiki/Continuous Monitoring|Continuous Monitoring]]. ## Sources / Provenance - [NIST — SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final)