Cybersecurity
Risk Management Framework Support
RMF, NIST SP 800-53, and authorization support for federal work through teaming partners.
What this covers
Federal systems, and some state systems that connect to them, follow the NIST Risk Management Framework: categorize, select, implement, assess, authorize, and monitor. HQT supports RMF work as a subcontractor to prime contractors and for state agencies that operate federally connected systems.
Typical activities
- System categorization and boundary definition
- Control selection and tailoring from NIST SP 800-53
- System security plan and supporting documentation
- Control implementation and evidence collection
- Support for assessment and plan of action and milestones tracking
- Continuous monitoring design
What you receive
Authorization package documentation, implemented controls, an evidence repository, and a continuous monitoring plan.
Considerations
RMF work performed for federal customers is done through teaming partners who hold the prime contract. HQT's role is technical and documentary support under that arrangement.
Signals that RMF applies to your systems
RMF is a federal process, so the trigger is usually an outside connection rather than an internal decision. Signals worth acting on:
- A prime contractor asks for a system security plan, a control implementation summary, or evidence for controls nobody on your team has documented.
- A federal partner standing up an interconnection or data feed asks for an interconnection security agreement or a copy of your authorization decision.
- A grant condition or data use agreement cites NIST SP 800-53 control families directly rather than a state standard.
- A system is moving to a cloud service and the documented boundary no longer matches how it is deployed.
- The authorization termination date in the authorization decision document is approaching, or the continuous monitoring reporting the authorizing official expects has stopped.
If nothing federal touches the system, a program built on the NIST Cybersecurity Framework or the CIS Controls usually fits better. What RMF produces is an authorization decision, not a set of documents.
Marks of a sound authorization package
A sound package starts from a boundary that matches how the system actually runs, with interconnections named and inherited controls attributed to the hosting provider or shared service that provides them. Implementation statements name the mechanism, the system that enforces it, the responsible role, and evidence that can be regenerated rather than rewritten. The Prepare step in the current revision of NIST SP 800-37 exists for that reason, since boundary, categorization, and common control decisions are cheaper to settle before drafting starts.
Recurring failure modes:
- Implementation statements that paraphrase the control language without naming a mechanism.
- A boundary drawn around an entire data center, pulling unrelated systems into scope and multiplying assessment work for no benefit.
- Evidence assembled by hand before each assessment, which turns every monitoring cycle into a reconstruction.
- A plan of action and milestones used as a filing cabinet for findings instead of a schedule with owners, resources, and dates.
- A package nobody inside the agency can explain or maintain once the contractor leaves.
Where RMF meets obligations you already carry
Agencies in this position usually carry other control obligations. IRS Publication 1075 for federal tax information and the CMS Minimum Acceptable Risk Standards for Exchanges both draw on NIST SP 800-53, and current versions of the FBI CJIS Security Policy include a mapping to it. One evidence set can answer several audiences when it is organized by control rather than by audit, so build that crosswalk early rather than maintaining parallel binders.
Two integration points matter here. When the system runs on a FedRAMP authorized cloud service, you inherit what the provider's customer responsibility matrix says you inherit, and the rest stays yours. Evidence should come from tools already in operation: the vulnerability scanner, the identity system, the configuration platform, the ticket queue. Ask whether security plan and milestone data can be delivered in OSCAL, the machine readable format NIST publishes for it, so the package stays portable across vendors.
What to require in an RMF solicitation
- Name the publications and revisions you expect: SP 800-37 for the process, SP 800-53 and SP 800-53B for controls and baselines, SP 800-53A for assessment procedures, and FIPS 199 with SP 800-60 for categorization. State any overlays that apply.
- State that the authorizing official is a government official of the organization that owns the system. A vendor can prepare, implement, and support assessment, and cannot accept risk or promise an authorization decision.
- Keep package preparation and security control assessment in separate awards, or require documented assessor independence from the staff who wrote the plan and implemented the controls.
- Require native editable files for the security plan, assessment artifacts, and milestone data, held in agency controlled storage.
- Define finding response: how many rounds of assessor comment resolution are included, and within what period.
- Require stated continuous monitoring frequencies, named report recipients, and a transition plan naming the agency staff who take over each recurring task.
Working with HQT on this
HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.
Frequently asked questions
Do state and local agencies have to follow the NIST Risk Management Framework?
RMF is a federal process defined in NIST SP 800-37, and it is not generally imposed on state or local systems on its own. It usually reaches those agencies indirectly, through systems that interconnect with federal systems, through grant conditions or data use agreements that cite NIST SP 800-53, and through subcontract work supporting a federal prime contractor. Where no federal connection or requirement exists, the NIST Cybersecurity Framework or the CIS Controls is usually a better starting point.
What is the difference between RMF and FedRAMP?
RMF is the process an organization uses to categorize a system, select and implement controls, assess them, and reach an authorization decision. FedRAMP applies that approach to cloud service offerings and standardizes the packages so a cloud authorization can be reused across federal agencies. Running on a FedRAMP authorized service does not authorize the system you build on it. You still authorize your own system, and you inherit only what the provider's customer responsibility matrix says you inherit.
Can a contractor grant an authorization to operate?
No. The authorization decision belongs to a government authorizing official who formally accepts the risk on behalf of the organization, and that role cannot be handed to a vendor. A contractor can help define the boundary, draft the system security plan, implement controls, collect evidence, and support assessment and remediation. Treat a promised or guaranteed authorization as a reason to ask harder questions.
How long does an RMF authorization package take?
It depends on the categorization level, the size of the boundary, how many controls are inherited from a cloud provider or a common control program, and how much of the environment is already documented. Evidence is usually the largest variable, since pulling configuration, scan, and log data from running systems is far quicker than reconstructing it by hand. Ask for a milestone based schedule rather than a fixed duration quoted before the boundary and categorization are settled.
What does our agency have to provide during an RMF engagement?
Access to system owners and administrators, current architecture and data flow documentation, an inventory of interconnections and the data types involved, existing policies and procedures, and read access to configuration and vulnerability data. You also supply the decisions no vendor can make for you: the system boundary, the security categorization, the risk acceptance, and the authorizing official. Name one agency lead with time actually available for the work, since questions arrive continuously through the assess and authorize steps.