August 3, 2026
What Is the CGRC Certification and Who Should Pursue It?
A practical guide to ISC2's CGRC certification: the seven domains, exam format, experience requirements, and whether it fits your federal or DoD career path.
Read Article
May 11, 2026
DoD 8140 vs DoD 8570: What Federal IT Professionals Need to Know
Confused about the DoD 8570 to 8140 transition? Learn what changed, which certifications are required, and how to stay compliant in your federal IT role.
Read Article
May 24, 2024
RMF Alignment with ISC2’s CGRC Exam
How IT Dojo's RMF training aligns with the ISC2 CGRC exam (formerly CAP), and why the Risk Management Framework is the core of the CGRC content.
Read Article
April 17, 2024
Strengthening Cybersecurity: Navigating the Risk Management Framework for DoD IT
In an era marked by evolving cyber threats and stringent security requirements, the Department of Defense (DoD) plays a pivotal role in safeguarding…
Read Article
September 27, 2023
Navigating the Risk Management Framework (RMF) for DoD and Government Agencies
In today's tech-driven world, safeguarding sensitive data and critical systems is a top priority, especially for government agencies, including the…
Read Article
June 28, 2023
RISK MANAGEMENT FRAMEWORK (RMF) TOMORROW: TRUTH OR FICTION?
Lon Berman separates truth from rumor about the future of the Risk Management Framework, including whether DoD will abandon RMF for its own approach.
Read Article
February 8, 2022
DoD Transition to NIST SP 800-53 Rev 5 … Why is it Taking so Long?
Welcome to 2022! It’s now been well over a year since the release of NIST SP 800-53 Rev 5, yet Rev 4 remains the DoD standard.
Read Article
May 25, 2021
Risk. What to Do With It.
Recently our regional grocery store chain notified their employees and customers that they had a data breach involving some HR data and pharmacy records.
Read Article
May 25, 2021
RMF Across the Government Landscape
More than ten years ago, RMF came into existence with the intention of becoming the “unified information security framework for the federal government”.
Read Article
January 12, 2021
Welcome, Step 0
Q. The Risk Management Framework (RMF) life cycle is comprised of how many steps? A. Oh, that’s easy, it’s six. Well … not so fast.
Read Article
April 15, 2019
Security Control Inheritance
CNSSI 4009 defines security control inheritance: how systems receive protection from controls managed outside their own boundary.
Read Article
January 11, 2019
Powerful but not well understood: Reciprocity, Type Authorization, and Assess Only
All of us who have spent time working with RMF have come to understand just what a time-consuming and resource-intensive process it can be.
Read Article
October 9, 2018
Is RMF Broken? Can it be fixed or is it beyond repair?
Thanks to the work of the Joint Task Force, RMF is now the official information security life cycle process across all three “segments” of the Executive…
Read Article
April 17, 2018
RMF and the Defense Security Service (DSS)
What cleared contractors need to know about RMF and the Defense Security Service (DSS), now DCSA, including NISP oversight of classified systems.
Read Article
October 17, 2017
Is Your System a National Security System (NSS)? and How Does That Affect RMF Efforts?
By federal law, an information system will be designated as a National Security System (NSS) in accordance with the following definition: The term “national…
Read Article
October 17, 2017
RMF: Is It Effective?
In July 2017, SolarWinds surveyed about 200 federal IT decision makers on RMF effectiveness. Here is what the results revealed.
Read Article
July 13, 2017
Continuous Monitoring Today: And Tomorrow
This article was written by Lon Berman, CISSP, RDRP of BAI Information Security Step 6 of the Risk Management Framework (RMF) is entitled “Monitor Security…
Read Article
July 13, 2017
Security Control Spotlight: Inheritance from a FedRAMP Approved CSP
How RMF security control inheritance works with a FedRAMP approved cloud service provider such as AWS or Azure, and what system owners still own.
Read Article
September 16, 2016
Security Control Spotlight: Contingency Planning
A look at the RMF Contingency Planning (CP) control family: what disaster recovery and continuity plans must cover and how requirements scale.
Read Article
September 16, 2016
Top Ten RMF Pitfalls Revisited
Like any complex process, RMF is not without its share of potential pitfalls. Now that we have the benefit of some more RMF projects under our belt, we…
Read Article
September 16, 2016
Understanding the Authorization Decision
Most system owners expect an Authorization to Operate from their RMF efforts. Here is what the AO decision really involves.
Read Article
June 8, 2016
Top Ten: RMF “Lessons Learned”
I recently had the pleasure of consulting for a DoD program that successfully navigated the RMF process and received a full three year Authorization to…
Read Article
June 7, 2016
Security Control Baseline “Tabletop Review”
Let’s take a look at some strategies for reviewing the Security Control Baseline and creating “action plans” for implementation.
Read Article
June 1, 2016
Security Control Spotlight: Inheritance
Security control inheritance can speed up the RMF process but is often misapplied. What it means, how it works, and how to document it correctly.
Read Article
March 1, 2016
Top Ten: Questions for your Authorizing Official
Ten questions to ask your Authorizing Official (AO) early in the RMF process so your system is on track for an Authorization to Operate (ATO).
Read Article
November 23, 2015
Security Control Spotlight: A Little Good News?
Imagine this dialog between Edward, a System Owner, and Christine, his Information System Security Manager (ISSM): Edward (System Owner):“Now that we’ve…
Read Article
March 13, 2015
Security Control Spotlight: The PM Family
The Beatles were comprised of how many musicians? Easy, right? They were called the “Fab Four”, so there were definitely 4.
Read Article
March 11, 2015
RMF Transition: What do I Really Need to Know?
A year after DoDI 8510.01 kicked off the DIACAP to RMF transition, here is what DoD system owners really need to know.
Read Article
January 27, 2015
Spotlight: Information Security Continuous Monitoring
No longer just a technical issue, instead a strategic program to manage cybersecurity risk. Targeted cyber attacks are a strategic organizational problem.
Read Article
November 13, 2014
Security Control Spotlight: By the Numbers
In this issue’s “Spotlight”, we’re not going to focus on any specific controls or families, but rather on a comparison of RMF controls and DIACAP controls.
Read Article
October 16, 2014
Spotlight: Transitioning to the Risk Management Framework (RMF)
With the publication of revised DoD Instruction 8510.01, adoption of the Risk Management Framework (RMF) by DoD has begun.
Read Article
July 21, 2014
Security Control Spotlight: Organization-Defined Parameters
Under RMF, NIST SP 800-53 is the primary source for security controls. If we compare these controls to the DoDI 8500.2 IA controls used in DIACAP, several…
Read Article
July 18, 2014
Top Ten: Ensuring a Smooth Transition to RMF
Now that DoD has “officially” begun its adoption of “RMF for DoD IT”, let’s take a look at some of the things your organization can do to ensure a smooth…
Read Article
April 22, 2014
What are the Steps in the Risk Management Framework Process?
The Risk Management Framework (RMF) is a seven-step process defined by NIST SP 800-37 and mandated for all federal and DoD information systems.
Read Article
April 10, 2014
Top 10 Things that Will Be Staying the Same with RMF
As DoD begins its transition from DIACAP to Risk Management Framework for DoD IT, everyone is naturally focused on all the things that will be…
Read Article
April 8, 2014
Top Ten: What’s “new” in RMF for DoD IT?
Now that DoD has “officially” begun its adoption of RMF, let’s take a look at some of the things that are “new”! 10. Cybersecurity.
Read Article
April 7, 2014
Continuous Monitoring: It’s Not (Just) About The Tools
by Annette Leonard BAI Consulting Continuous Monitoring has long been recognized as a critical element in maintaining a strong security posture for any IT…
Read Article
May 20, 2011
The Debate Surrounding Section 6.5.4.1
The IANA (Internet Assigned Number Authority) distributes IPv6 address to RIR's (Regional Internet Registry's) around the world.
Read Article