In part 6 of this series, we explore the Monitor step of the RMF is implemented using a data-driven approach.  The main objective of the Monitor step is to “maintain an ongoing situational awareness about the security and privacy posture of the information system and the organization in support of…

In part 5 of this series, we explore implementing the Authorize step of the Risk Management Framework using a data-driven approach. The main objective of the Authorize step is to “provide organizational accountability by requiring a senior management official to determine if the security and privacy risk (including supply chain…

In part 4 of this series, we explore the Risk Management Framework Assess step, using a data-driven approach.  The main objective of the Assess step is to “determine if the controls selected for implementation are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the…

In part 3 of this series, we investigate meeting the Risk Management Framework's Implement step, using a data-driven approach. The main objective of the Implement step is to “implement the controls in the security and privacy plans for the system and for the organization and to document in a baseline…