Platform
Modules
By sector
By sector
By standard
Blog
News
Events
NIST SP 800-37
US federal agencies and the contractors, cloud providers, and other external organizations that operate information systems on their behalf
NIST's seven-step Risk Management Framework for categorizing federal information systems, selecting and implementing security and privacy controls, and having an authorizing official decide whether the residual risk is acceptable.
NIST Special Publication 800-37 Revision 2 sets out the Risk Management Framework (RMF), the seven-step process the US National Institute of Standards and Technology built to bring security and privacy risk management for federal information systems and organizations into one repeatable framework. It is mandatory for federal government use; NIST wrote it so that "the RMF can be applied to any type of nonfederal organization" as well, on a voluntary basis, and FISMA and OMB policy separately require external providers that handle federal information or operate systems on the government's behalf to meet the same requirements as the agencies themselves. This is Revision 2, published December 2018.
The document names its participants directly rather than describing a generic "organization." The authorizing official is the only person who can accept the security and privacy risk to the organization's operations and assets, and, for federal agencies, that role "is an inherent U.S. Government function and is assigned to government personnel only." The system owner, and, where controls are shared across systems, the common control provider, assemble the evidence and submit it for a decision. A control assessor, selected to a degree of independence the authorizing official sets, tests the implemented controls, and a senior agency official for privacy runs a parallel track for any system that handles personal information. A wider set of supporting roles, the chief information officer, the senior agency information security officer, the senior accountable official for risk management, enterprise, security and privacy architects, and the people who actually administer and use the system, recur throughout.
Because FISMA and OMB policy extend the same expectations to "external providers handling federal information or operating systems on behalf of the federal government," the framework also, in effect, addresses any contractor or cloud provider standing in that relationship to a federal agency. For those organizations it binds the way most federal requirements do: through the contract or agreement that brings the relationship into being, not by existing on its own.
Prepare is the framework's foundational step, and it runs at two levels. At the organization level, done once rather than per system, an organization assigns its risk management roles, sets a risk management strategy and risk tolerance, runs an organization-wide risk assessment, identifies which controls it can provide centrally as common controls for other systems to inherit, and sets an organization-wide continuous monitoring strategy. At the system level, repeated for every system, Prepare identifies the mission the system supports, its stakeholders, the assets needing protection and, critically, the system's authorization boundary, "what the organization agrees to protect under its management control." Everything inside that boundary is this system's problem; everything outside it belongs to another system, or another organization's boundary entirely. The same system-level work continues through identifying the information types the system will process, a system-level risk assessment, defining security and privacy requirements, placing the system in the enterprise architecture, and registering it with the organization's management offices.
The system owner and the information owner or steward document the system's characteristics and categorize it, typically against FIPS 199 and FIPS 200's impact levels, before the authorizing official reviews and approves the result; a system spanning multiple impact levels takes the highest one that applies. Select draws controls from a pre-assembled baseline matched to that impact level, tailors them to the system's actual circumstances, and allocates them across the system and its operating environment, with the plan documented in security and privacy plans the authorizing official approves. Implement puts the controls in place and updates the documentation to describe the system as actually built. Assess is where an independent control assessor, working to whatever degree of independence the authorizing official has set, tests what was implemented and reports the results; for a system-level assessment the assessor does not retest controls the system inherits from a common control provider, only what the system implements itself. Deficiencies are either remediated and reassessed or carried forward in a documented plan of action and milestones.
The system owner or common control provider assembles an authorization package, an executive summary, the security and privacy plans, the assessment reports, and the plan of action and milestones, and submits it to the authorizing official, who analyzes the risk, decides how to respond, and then makes the authorization decision itself: an authorization to operate, a common control authorization, an authorization to use (typically where one organization relies on another's already-authorized system), or a denial where the risk cannot be brought down to an acceptable level in time. That specific decision cannot be delegated to the authorizing official's designated representative. Monitoring does not stop once a system is authorized: it begins at the start of operations and continues through disposal, tracking changes, running ongoing assessments that can double as the annual assessment FISMA itself calls for, and keeping the authorization package current. A defined set of event triggers, a new vulnerability, a significant change, a change of authorizing official, forces an immediate review. An organization whose continuous monitoring meets the required rigor can move a system onto ongoing authorization, where the authorizing official's current knowledge of the system substitutes for a fixed reauthorization date.
For systems that depend on an external provider's infrastructure, the framework lets an organization leverage the provider's own controls and assessment results, while cautioning that scope, rigor and assessor independence vary by provider and that organizations "should exercise caution" relying on them. One example the document names directly: a provisional authorization to operate issued under the Federal Risk and Authorization Management Program (FedRAMP) can be the basis a customer organization relies on for its own authorization to use a cloud system.
Nobody is "NIST SP 800-37 certified." There is no certification against this document: it names no accredited certification body and describes no certification scheme. Conformity runs through the authorizing official's own risk-acceptance decision, recorded in an authorization decision document that sets out the decision, its terms and conditions, and either a termination date or an ongoing-authorization review frequency. Nothing here is issued by an outside body: it is one organization's own senior official accepting risk for a system that organization owns, and the decision does not transfer to another organization except where that organization deliberately relies on it, as a customer does when it issues its own authorization to use on the strength of a provider's existing authorization.
NIST SP 800-37 is built to work alongside a cluster of other NIST publications rather than stand alone. The control catalog the Select step draws from lives in the separate publication SP 800-53, whose companions SP 800-53B (baselines) and SP 800-53A (assessment procedures) support the Select and Assess steps respectively. FIPS 199 and FIPS 200 supply the impact levels Categorize applies. SP 800-39 supplies the organization, mission and system risk model the framework sits on; SP 800-30 the risk assessment methodology; SP 800-137 the continuous monitoring guidance. None of these is held separately in this catalogue.
Outside the NIST series, NIST publishes a mapping from its own control catalog to ISO/IEC 27001's security controls, and to ISO/IEC 15408-2 and 15408-3's Common Criteria security requirements. The document is explicit that the mapping is background reading, not an equivalence to rely on directly: it calls such mappings "inherently subjective" and expects an organization to review one itself before leaning on it.
NIST SP 800-37 is a process and evidence framework, not a piece of software, so ComplyTrain is the system an organization runs the paperwork side of that process in, alongside the technical security controls its engineering teams implement directly. Concretely: the risk management roles an organization assigns in Prepare, its security and privacy plans, its assessment reports, its plans of action and milestones, and the authorization package built from all of them live as controlled, versioned records with an owner and a review history, ready to hand to an authorizing official or an assessor rather than assembled under deadline. The continuous monitoring evidence Monitor calls for, and the record of which controls a system inherits from which common control provider, sit in the same auditable place.
What ComplyTrain does not do: it does not select, implement, or technically configure a single security or privacy control, it does not perform the control assessment, and it does not make the authorization decision. That judgment stays with the organization's own authorizing official, exactly as the framework requires.
Most readers arrive at this page already holding a federal contract clause, a customer's request for an authorization package, or a FedRAMP- or CMMC-adjacent requirement to show how a system was risk-assessed and authorized. See what else sits alongside NIST SP 800-37 in the standards explorer, and talk to us about the evidence trail behind it.
Tell us how you need to work with NIST SP 800-37 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. The document names no accredited certification body and describes no certification scheme. Conformity runs through an authorizing official's own risk-acceptance decision inside the organization that owns the system, recorded as an authorization to operate, an authorization to use, or a common control authorization, never as a certificate issued by an outside body.
It is mandatory for federal government use. NIST built it so any nonfederal organization can adopt it voluntarily, and FISMA and OMB policy separately require external providers that handle federal information, or operate systems on the government's behalf, to meet the same requirements as the agencies they serve.
It is one of four decisions an authorizing official can make after reviewing a system's authorization package: an authorization to operate accepts the risk of running the system as it stands, an authorization to use accepts another organization's already-authorized system or common controls, a common control authorization covers controls offered for other systems to inherit, and a denial of authorization means the risk is judged unacceptable.
NIST SP 800-37 is the process, the seven-step Risk Management Framework that categorizes a system, selects controls for it, and authorizes it. NIST SP 800-53 is the separate control catalog the Select step chooses from; SP 800-37 does not itself list security or privacy controls.
It is a near-real-time alternative to a fixed reauthorization date. Once an organization's continuous monitoring program meets the rigor the framework expects, the authorizing official's up-to-date knowledge of the system's security and privacy posture can substitute for a static, point-in-time reauthorization.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.