The NIST Risk Management Framework: Problems and recommendations

Don Maclean
Additional contact information
Don Maclean: Don Maclean, Chief Cybersecurity Technologist, DLT – A Tech Data Company, USA

Cyber Security: A Peer-Reviewed Journal, 2017, vol. 1, issue 3, 207-217

Abstract: Cyber security assessment initiatives and frameworks abound in the US government, but their effectiveness is inconsistent. The most important law from which these frameworks and assessments arose is the Federal Information Systems Management Act (FISMA), passed in 2002, and updated as the Federal Information Systems Modernization Act in 2014. The law’s broad scope included a mandate to the US National Institute of Standards and Technology (NIST), charging it to create methods and standards to assess and optimise the cyber security posture of US government agencies. NIST’s flagship methodology, Risk Management Framework (RMF), is comprehensive and fundamentally sound, but years of experience have exposed many flaws — some stemming from lack of proper adoption and execution, some from unintended consequences, and others arising from the relentless pace of innovation in technology. This paper examines the RMF’s weaknesses, and offers recommendations for improvement.

Keywords: National Institute of Science and Technology; Risk Management Framework; Plan of Action and Milestones; Federal Information Systems Management Act; risk assessment; Authority to Operate (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2017
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/4165/download/ (application/pdf)
https://hstalks.com/article/4165/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2017:v:1:i:3:p:207-217

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().