Question · RMF (SP 800-37)
What are the steps in the RMF (SP 800-37) authorization lifecycle?
SP 800-37 Rev. 2 sets out the seven-step RMF: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, ending in a risk-based authorization decision.
01 / The answer
The short answer
SP 800-37 Rev. 2 has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. Prepare sets organization- and system-level context and roles; Categorize assigns an impact level under FIPS 199; Select and Implement choose, tailor and put in place SP 800-53 controls; Assess checks that they work; Authorize is a senior official's decision to accept the residual risk (the ATO); and Monitor tracks controls and changes continuously, which can lead to ongoing authorization or reauthorization. It is a cycle, not a one-time gate.
02 / The rule
What RMF (SP 800-37) requires
SP 800-37 Rev. 2 sets out the seven-step RMF: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, ending in a risk-based authorization decision. It is the process behind federal ATOs and DoD and classified system authorizations, so AI systems in government settings are usually authorized through it.
- 01Prepare: set organization-wide risk strategy, roles and common controls before system work.
- 02Categorize the system and its information by impact level (FIPS 199).
- 03Select, tailor and implement SP 800-53 controls, and document them in security and privacy plans.
- 04Assess controls to confirm they are implemented correctly and working as intended.
03 / Records
Records to keep
- 01System categorization record
- 02Security and privacy plans with control implementations
- 03Security assessment report and plan of action and milestones
- 04Authorization decision and continuous monitoring strategy
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Management and Budget
RELATED
Related: RMF (SP 800-37): the full guide · How does SHA-256 pinning support continuous monitoring under RMF?