In this module, we explain some of the laws, policies and regulations which mandate the implementation of the NIST RMF and govern the execution of the NIST RMF. This module discusses the Privacy Act, the Computer Fraud and Abuse Act, the USA PATRIOT Act and more.

In this module, we describe the basic concepts associated with managing information system-related security and privacy risk in organizations. Managing information system-related security and privacy risk is a complex undertaking that requires the involvement of the entire organization. Risk management is a holistic activity that affects every aspect of the organization and cannot be made in isolation. This module discusses risk, the system development life cycle, key roles and more.

In this module, we discuss the NIST RMF steps. describes the RMF and provides guidelines for applying it to information systems and organizations. We discuss the RMF structured and flexible process for managing security and privacy risk, as well as RMF activities to prepare organizations to execute the framework at appropriate risk management levels.

In this module, we review the six RMF steps: Categorize/Identify; Select; Implement; Assess; Authorize; and Monitor and provide an assessment to gauge your understanding of the course. In addition, there is a project in which you will review the categorization process by completing the NIST 800-60v1 categorization worksheet. You will then transfer the information over to the FIPS 199 Categorization Form and look at the six RMF steps.