NIST SP 800-37

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-06-30 SP 800-18 Rev. 2 published, aligning system security, privacy and C-SCRM plan development with the RMF steps and tasks
2. 2019-12-20 SP 800-37 Rev. 1 withdrawn, one year after Rev. 2
3. 2018-12-20 SP 800-37 Rev. 2 published

1. 2018-12-20
   SP 800-37 Rev. 2 Major versionCurrent

   Retitled "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy". source

   More

   • It added a Prepare step, linked the RMF to executive-level risk management, and showed how to implement the Cybersecurity Framework through it.
   • Privacy risk management, supply chain risk management and systems engineering (SP 800-160) were integrated, and an organization-generated control selection approach was allowed alongside baselines.
2. 2018-10-02
   SP 800-37 Rev. 2 (final public draft) Draft

   Final public draft; comments closed 31 October 2018. source

3. 2018-05-09
   SP 800-37 Rev. 2 (public draft) Draft

   Public draft; comments closed 22 June 2018. source

4. 2017-09-28
   SP 800-37 Rev. 2 (first draft) Draft

   First draft of Revision 2. source

5. 2014-06-05
   SP 800-37 Rev. 1 (update 1) Errata source

   Not confirmed by an official source yet.

OMB Circular A-130 requires federal agencies to implement the RMF described in SP 800-37; nongovernmental organizations may use it voluntarily.

Federal agencies

OMB Circular A-130 requires federal agencies to implement the RMF described in SP 800-37 and to integrate privacy into it. source source

What agencies do

Agencies use it to categorize systems, select, implement and assess controls, authorize systems and common controls, and monitor them continuously. source source

National security systems

It does not apply to national security systems without approval of the officials responsible for them. source

Other organizations

Nongovernmental organizations may use it voluntarily. source

Contractors

The RMF gives the civil, defense and intelligence communities of the federal government and their contractors common methods to manage security and privacy risks. source

The RMF ends in an authorization decision, and continuous monitoring then keeps the authorization current.

Authorization

The RMF ends in an authorization decision: an agency authorizing official accepts the risk and issues an authorization to operate (or to use), based on the assessment results and plan of action and milestones. source

Continuous monitoring

Continuous monitoring then keeps the authorization current; Rev. 2 also describes ongoing authorization. source source

Certification

NIST does not offer or endorse any program or tool for compliance with its risk management guidance. source

NIST is not a regulatory agency; under OMB Circular A-130, authorizing officials decide on authorizations and agencies report under FISMA.

Not a regulator

NIST is not a regulatory agency. source

Federal agencies

Under OMB Circular A-130, the decision to authorize a system is made by the appropriate authorizing official, and agencies provide FISMA reports in accordance with processes established by OMB and DHS. source

1. Standard NIST SP 800-37 Rev. 2 – Risk Management Framework for Information Systems and Organizations (PDF)
2. Guidance NIST Risk Management Framework project page
3. Law text OMB Circular A-130 – Managing Information as a Strategic Resource

1. NIST SP 800-53

   SP 800-53 is the control catalog; SP 800-37 is the process that selects, assesses and authorizes those controls for a system.

2. NIST CSF

   The CSF states organization-level outcomes; SP 800-37 Rev. 2 shows how to implement the CSF through the RMF.

3. FedRAMP

   FedRAMP applies RMF-style authorization to cloud services used across agencies, with its own baselines and continuous monitoring rules.

4. ISO 27005

   ISO/IEC 27005 is international guidance on information security risk management; the RMF is the US federal process that ends in a system authorization.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NIST SP 800-37 (RSS)