Question · RMF (SP 800-37)
How does SHA-256 pinning support continuous monitoring under RMF?
SP 800-37 Rev. 2 sets out the seven-step RMF: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, ending in a risk-based authorization decision.
01 / The answer
The short answer
It makes change detectable. The RMF Monitor step requires ongoing awareness of changes to the system and its environment and their effect on risk. Recording SHA-256 digests of the model file, configuration, test set and results lets each monitoring run show it tested the same artifacts as the last, or exactly what changed. That supports SP 800-53 configuration management (CM) and integrity (SI) controls and informs whether a change needs reassessment or reauthorization. Hashing shows that something changed, not whether the change is acceptable; the authorizing official decides that.
02 / The rule
What RMF (SP 800-37) requires
SP 800-37 Rev. 2 sets out the seven-step RMF: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, ending in a risk-based authorization decision. It is the process behind federal ATOs and DoD and classified system authorizations, so AI systems in government settings are usually authorized through it.
- 01Prepare: set organization-wide risk strategy, roles and common controls before system work.
- 02Categorize the system and its information by impact level (FIPS 199).
- 03Select, tailor and implement SP 800-53 controls, and document them in security and privacy plans.
- 04Assess controls to confirm they are implemented correctly and working as intended.
03 / Records
Records to keep
- 01System categorization record
- 02Security and privacy plans with control implementations
- 03Security assessment report and plan of action and milestones
- 04Authorization decision and continuous monitoring strategy
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Management and Budget
RELATED
Related: RMF (SP 800-37): the full guide · What are the steps in the RMF (SP 800-37) authorization lifecycle?