May 11, 2026
DoD 8140 vs DoD 8570: What Federal IT Professionals Need to Know
Confused about the DoD 8570 to 8140 transition? Learn what changed, which certifications are required, and how to stay compliant in your federal IT role.
Read Article
May 24, 2024
RMF Alignment with ISC2’s CGRC Exam
IT Dojo's training programs were developed with the information systems professional in mind.
Read Article
April 17, 2024
Strengthening Cybersecurity: Navigating the Risk Management Framework for DoD IT
In an era marked by evolving cyber threats and stringent security requirements, the Department of Defense (DoD) plays a pivotal role in safeguarding…
Read Article
September 27, 2023
Navigating the Risk Management Framework (RMF) for DoD and Government Agencies
In today's tech-driven world, safeguarding sensitive data and critical systems is a top priority, especially for government agencies, including the…
Read Article
June 28, 2023
RISK MANAGEMENT FRAMEWORK (RMF) TOMORROW: TRUTH OR FICTION?
JULY 2023, VOLUME 15, ISSUE 3 When it comes to the future of RMF, rumors abound but truth is hard to come by.
Read Article
February 8, 2022
DoD Transition to NIST SP 800-53 Rev 5 … Why is it Taking so Long?
Welcome to 2022! It’s now been well over a year since the release of NIST SP 800-53 Rev 5, yet Rev 4 remains the DoD standard.
Read Article
May 25, 2021
Risk. What to Do With It.
Recently our regional grocery store chain notified their employees and customers that they had a data breach involving some HR data and pharmacy records.
Read Article
May 25, 2021
RMF Across the Government Landscape
More than ten years ago, RMF came into existence with the intention of becoming the “unified information security framework for the federal government”.
Read Article
January 12, 2021
Welcome, Step 0
Q. The Risk Management Framework (RMF) life cycle is comprised of how many steps? A. Oh, that’s easy, it’s six. Well … not so fast.
Read Article
November 12, 2019
Ask Dr. RMF!
Dear Dr. RMF, I work in an Army program and I feel like I am getting the hang of RMF, but when the heck do I schedule an independent assessment (SCA-V)?
Read Article
April 15, 2019
Ask Dr. RMF
Dear Dr. RMF, Government IT Security staff work with systems owners to make sure that all systems in the agency have implemented the proper Risk Management…
Read Article
April 15, 2019
Security Control Inheritance
CNSSI 4009 defines Security Control Inheritance as “a situation in which an information system or application receives protection from security controls (or…
Read Article
January 11, 2019
Powerful but not well understood: Reciprocity, Type Authorization, and Assess Only
All of us who have spent time working with RMF have come to understand just what a time-consuming and resource-intensive process it can be.
Read Article
October 9, 2018
Is RMF Broken? Can it be fixed or is it beyond repair?
Thanks to the work of the Joint Task Force, RMF is now the official information security life cycle process across all three “segments” of the Executive…
Read Article
April 17, 2018
RMF and the Defense Security Service (DSS)
The Defense Security Service (DSS) serves as an interface between the government and cleared industry.
Read Article
October 17, 2017
Is Your System a National Security System (NSS)? and How Does That Affect RMF Efforts?
By federal law, an information system will be designated as a National Security System (NSS) in accordance with the following definition: The term “national…
Read Article
October 17, 2017
RMF: Is It Effective?
In July 2017, SolarWinds conducted an online survey via Market Connections aimed at approximately 200 federal government IT decision makers and influencers…
Read Article
July 13, 2017
Continuous Monitoring Today: And Tomorrow
This article was written by Lon Berman, CISSP, RDRP of BAI Information Security Step 6 of the Risk Management Framework (RMF) is entitled “Monitor Security…
Read Article
July 13, 2017
Security Control Spotlight: Inheritance from a FedRAMP Approved CSP
This article was written by Kathryn M. Daily, CISSP, RDRP of BAI Information Security.
Read Article
September 16, 2016
Security Control Spotlight: Contingency Planning
In this issue we will shine the spotlight on the Contingency Planning (CP) family of security controls.
Read Article
September 16, 2016
Top Ten RMF Pitfalls Revisited
Like any complex process, RMF is not without its share of potential pitfalls. Now that we have the benefit of some more RMF projects under our belt, we…
Read Article
September 16, 2016
Understanding the Authorization Decision
If you ask most system owners about the desired outcome of their RMF efforts, they will readily tell you “we are expecting the Authorizing Official (AO) to…
Read Article
June 8, 2016
Top Ten: RMF “Lessons Learned”
I recently had the pleasure of consulting for a DoD program that successfully navigated the RMF process and received a full three year Authorization to…
Read Article
June 7, 2016
Security Control Baseline “Tabletop Review”
Let’s take a look at some strategies for reviewing the Security Control Baseline and creating “action plans” for implementation.
Read Article
June 1, 2016
Security Control Spotlight: Inheritance
Security Control Inheritance is one of the most powerful tools available to facilitate the RMF process.
Read Article
March 1, 2016
Top Ten: Questions for your Authorizing Official
The importance of the Authorizing Official (AO) in the RMF process is self evident.
Read Article
November 23, 2015
Security Control Spotlight: A Little Good News?
Imagine this dialog between Edward, a System Owner, and Christine, his Information System Security Manager (ISSM): Edward (System Owner):“Now that we’ve…
Read Article
March 13, 2015
Security Control Spotlight: The PM Family
The Beatles were comprised of how many musicians? Easy, right? They were called the “Fab Four”, so there were definitely 4.
Read Article
March 11, 2015
RMF Transition: What do I Really Need to Know?
It’s hard to believe it’s been a whole year since the publication of DoD Instruction (DoDI) 8510.01 in March of 2014, which officially began the transition…
Read Article
January 27, 2015
Spotlight: Information Security Continuous Monitoring
No longer just a technical issue, instead a strategic program to manage cybersecurity risk. Targeted cyber attacks are a strategic organizational problem.
Read Article
November 13, 2014
Security Control Spotlight: By the Numbers
In this issue’s “Spotlight”, we’re not going to focus on any specific controls or families, but rather on a comparison of RMF controls and DIACAP controls.
Read Article
October 16, 2014
Spotlight: Transitioning to the Risk Management Framework (RMF)
With the publication of revised DoD Instruction 8510.01, adoption of the Risk Management Framework (RMF) by DoD has begun.
Read Article
July 21, 2014
Security Control Spotlight: Organization-Defined Parameters
Under RMF, NIST SP 800-53 is the primary source for security controls. If we compare these controls to the DoDI 8500.2 IA controls used in DIACAP, several…
Read Article
July 18, 2014
Top Ten: Ensuring a Smooth Transition to RMF
Now that DoD has “officially” begun its adoption of “RMF for DoD IT”, let’s take a look at some of the things your organization can do to ensure a smooth…
Read Article
April 22, 2014
What are the Steps in the Risk Management Framework Process?
The Risk Management Framework (RMF) is a seven-step process defined by NIST SP 800-37 and mandated for all federal and DoD information systems.
Read Article
April 10, 2014
Top 10 Things that Will Be Staying the Same with RMF
As DoD begins its transition from DIACAP to Risk Management Framework for DoD IT, everyone is naturally focused on all the things that will be…
Read Article
April 8, 2014
Top Ten: What’s “new” in RMF for DoD IT?
Now that DoD has “officially” begun its adoption of RMF, let’s take a look at some of the things that are “new”! 10. Cybersecurity.
Read Article
April 7, 2014
Continuous Monitoring: It’s Not (Just) About The Tools
by Annette Leonard BAI Consulting Continuous Monitoring has long been recognized as a critical element in maintaining a strong security posture for any IT…
Read Article
May 20, 2011
The Debate Surrounding Section 6.5.4.1
The IANA (Internet Assigned Number Authority) distributes IPv6 address to RIR's (Regional Internet Registry's) around the world.
Read Article