Planisphere Download for Mac

Defense · RMF (SP 800-37)

RMF (SP 800-37) for defense AI workflows

RMF (SP 800-37) in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceMandatory for federal agencies through OMB A-130; voluntary for others
Applies from20 Dec 2018
SectorDefense
Checked21 Oct 2026

01 / The rule

What RMF (SP 800-37) requires

Federal agencies and their system owners and authorizing officials; also used by contractors (for example under 32 CFR part 117) and others voluntarily.

  1. 01Prepare: set organization-wide risk strategy, roles and common controls before system work.
  2. 02Categorize the system and its information by impact level (FIPS 199).
  3. 03Select, tailor and implement SP 800-53 controls, and document them in security and privacy plans.
  4. 04Assess controls to confirm they are implemented correctly and working as intended.
  5. 05Obtain a senior official's authorization decision and continuously monitor controls and risk.

02 / In this sector

In a defense AI workflow

Applies to AI systems as to any system; AI-specific risks such as model and data changes are handled through categorization, control tailoring (for example overlays) and continuous monitoring.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

  1. 01System categorization record
  2. 02Security and privacy plans with control implementations
  3. 03Security assessment report and plan of action and milestones
  4. 04Authorization decision and continuous monitoring strategy

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

RELATED

Related: RMF (SP 800-37): the full guide · RMF (SP 800-37) for medicine · RMF (SP 800-37) for law · RMF (SP 800-37) for education