The NIST Risk Management Framework has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. For a software team, it is a repeatable path from "we built a system" to "an authorizing official accepted its risk." Monitoring never ends, so treat it as a loop.
The steps in plain words
NIST SP 800-37 Rev. 2, published in December 2018, defines the framework. It covers security and privacy risk and builds both into the system life cycle.
- Prepare. Do the groundwork so the organization can manage security and privacy risk. Name roles, set risk tolerance and decide scope.
- Categorize. Assign impact levels to the system and its information based on an impact analysis.
- Select. Choose the SP 800-53 controls that will protect the system, based on risk assessment.
- Implement. Deploy the controls and document how they are set up.
- Assess. Check that controls are in place, work as intended and produce the desired results.
- Authorize. A senior official makes a risk-based decision on whether the system may operate.
- Monitor. Keep watching control implementation and risk on an ongoing basis.
What each step means for engineers
Prepare and Categorize are mostly paperwork, but engineers need to be in the room. The data types you handle set the impact level.
Select and Implement are where your pipeline matters. Controls on change management, vulnerability scanning, access and logging become tickets, configuration and automated checks. Write down how each one is met, since that text becomes your system security plan.
Assess is where an independent party tests your claims. Evidence that the pipeline produces automatically is easier to defend than screenshots.
Authorize is a decision, not a document. Prepare a short, honest risk summary and a plan for open items.
Monitor is the longest step. SP 800-37 describes support for near real time risk management and ongoing authorization, so plan for continuous evidence from the start.
Common traps
Starting at Implement because the code already exists. Without categorization you may build to the wrong baseline.
Writing the plan after the build. It then describes what you wish you had done.
Treating authorization as the finish line. Changes after it can alter the risk picture, and the framework expects you to keep reporting.
Where tooling fits
Safeguard offers compliance and evidence automation, policy gates in the build and SBOM and dependency scanning, which supply evidence for the Implement, Assess and Monitor steps. They support the process. They do not grant an authorization, and Safeguard makes no such claim.
Quick check
Which RMF step picks the controls?
Select. It chooses SP 800-53 controls based on risk assessments, after Categorize sets the impact level.
Is the Monitor step a one-time review?
No. NIST describes it as ongoing watching of control implementation and system risk.
Click through it at your own pace, or open it full screen.
Sources
Last reviewed: 19 October 2026.
