The NIST Risk Management Framework has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. An engineering team owns records at most of them: a system description, a categorization input, implementation notes, assessment evidence, a plan of action and continuous monitoring data.
The steps and your records
The NIST RMF page describes each step in one line. Here they are with what an engineering team usually contributes. The records column is practical guidance, not NIST wording.
- Prepare. NIST description: Get the organization ready to manage risk; What you usually own: Roles, system boundary draft, tool list
- Categorize. NIST description: Classify the system and information by impact; What you usually own: Information types processed, data flow notes
- Select. NIST description: Choose SP 800-53 controls based on risk; What you usually own: Notes on which controls you inherit and which you own
- Implement. NIST description: Put controls in place and document how; What you usually own: Configuration, pipeline settings, plan text
- Assess. NIST description: Check controls are implemented and working; What you usually own: Test and scan evidence, access to staff
- Authorize. NIST description: A senior official makes a risk decision; What you usually own: Plan of action entries, accurate system plan
- Monitor. NIST description: Track controls and risks continuously; What you usually own: Scan data, change records, alert history
Step by step
Prepare. Name who is accountable and write the boundary before anyone argues about controls.
Categorize. The FIPS 199 impact rating drives the baseline. Our post on FIPS 199 categorization explains how ratings are chosen.
Select. SP 800-53B defines low, moderate and high baselines with tailoring guidance. Your selection is the baseline plus tailoring decisions, written down.
Implement. Most of your work. Document how each control is met in the system plan, per SP 800-18 Rev. 2.
Assess. SP 800-53A gives assessment procedures. Expect to hand over evidence and answer questions.
Authorize. The authorizing official reads your plan of action and decides whether the risk is acceptable. Weak items you cannot fix before this point belong on the plan, with dates.
Monitor. NIST SP 800-137 describes continuous monitoring as insight into assets, threats and vulnerabilities and whether controls work.
Where teams stumble
They treat Authorize as the finish line. In the RMF it is step six of seven, and the framework description stresses near real-time risk management and ongoing authorization. The evidence you produce after authorization matters as much as before.
Try it yourself
Click a control and look at which evidence supports it, the kind of record the Assess step uses.
Click through it at your own pace, or open it full screen.
Quick check
How many steps does the RMF have?
Seven, per the NIST RMF page: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
Which step uses SP 800-53A?
Assess. SP 800-53A provides methodology and procedures for assessing controls.
Safeguard's compliance and evidence automation, asset discovery and SBOM scanning produce the Implement, Assess and Monitor records. A free scan is at gold.safeguard.sh/scan.
Sources
- NIST RMF overview
- NIST SP 800-37 Rev. 2
- NIST SP 800-53A Rev. 5
- NIST SP 800-53B
- NIST SP 800-137
- NIST SP 800-18 Rev. 2
Last reviewed: 19 October 2026.
