United States (federal) · federal standard
RMF (SP 800-37): what it asks, and the records to keep
SP 800-37 Rev. 2 sets out the seven-step RMF: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, ending in a risk-based authorization decision. It is the process behind federal ATOs and DoD and classified system authorizations, so AI systems in government settings are usually authorized through it.
01 / What it asks
What RMF (SP 800-37) asks
Federal agencies and their system owners and authorizing officials; also used by contractors (for example under 32 CFR part 117) and others voluntarily.
- 01Prepare: set organization-wide risk strategy, roles and common controls before system work.
- 02Categorize the system and its information by impact level (FIPS 199).
- 03Select, tailor and implement SP 800-53 controls, and document them in security and privacy plans.
- 04Assess controls to confirm they are implemented correctly and working as intended.
- 05Obtain a senior official's authorization decision and continuously monitor controls and risk.
02 / AI work
Where it touches AI work
Applies to AI systems as to any system; AI-specific risks such as model and data changes are handled through categorization, control tailoring (for example overlays) and continuous monitoring.
03 / Dates
The dates that matter
SP 800-37 Rev. 2 published, superseding Rev. 1
32 CFR part 117 (NISPOM) applies RMF to classified contractor systems
SP 800-53 Release 5.2.0 issued (control catalog used by RMF)
04 / Enforcement
Who enforces it
None directly; for agencies, OMB oversight, inspector general audits and FISMA reporting. No penalties.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01System categorization record
- 02Security and privacy plans with control implementations
- 03Security assessment report and plan of action and milestones
- 04Authorization decision and continuous monitoring strategy
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What are the steps in the RMF (SP 800-37) authorization lifecycle?+
SP 800-37 Rev. 2 has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. Prepare sets organization- and system-level context and roles; Categorize assigns an impact level under FIPS 199; Select and Implement choose, tailor and put in place SP 800-53 controls; Assess checks that they work; Authorize is a senior official's decision to accept the residual risk (the ATO); and Monitor tracks controls and changes continuously, which can lead to ongoing authorization or reauthorization. It is a cycle, not a one-time gate. Read the full answer
How does SHA-256 pinning support continuous monitoring under RMF?+
It makes change detectable. The RMF Monitor step requires ongoing awareness of changes to the system and its environment and their effect on risk. Recording SHA-256 digests of the model file, configuration, test set and results lets each monitoring run show it tested the same artifacts as the last, or exactly what changed. That supports SP 800-53 configuration management (CM) and integrity (SI) controls and informs whether a change needs reassessment or reauthorization. Hashing shows that something changed, not whether the change is acceptable; the authorizing official decides that. Read the full answer
SOURCES
Go back to the source
Office of Management and Budget
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: RMF (SP 800-37) for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4