Strategic Implementation of the NIST Risk Management Framework (RMF)
summary
Step‑by‑step walkthrough of NIST SP 800‑37 applied to a medium‑sized Florida healthcare platform: stakeholder interviews, organization‑wide risk assessment, then Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor with concrete outputs — risk register, controls catalog, system security and privacy plans, POA&M and an authorization package for senior management. Demonstrates tailoring control baselines, allocating common vs system‑specific controls, using GRC tools to automate evidence and audits, and how continuous monitoring and reporting actually get operationalized.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 3:12What is the NIST RMF?
- 7:29RMF levels and organization-wide effort
- 10:00Step 1: Prepare in detail
- 20:47Step 2: Categorize the system
- 22:12Step 3: Select and tailor controls
- 27:05Step 4: Implement controls
- 28:51Step 5: Assess control effectiveness
- 31:38Step 6: Authorize system operation
- 34:06Step 7: Monitor ongoing security
- 36:40Conclusion and Q&A
related talks
40mProtecting What Matters Most – Tools for Managing Risk
40mThree’s Company: Unpacking and Settling in with Three NIST Frameworks
29mMeasuring Cybersecurity Maturity with the NIST CSF
25mCrash Course on AI Risk Management Framework
51mThe Overlooked Security Risk: 3rd Party Risk Management
40mTelehealth Cybersecurity: Secure Remote Patient Monitoring Ecosystem
40mCompliance Made Easy—Simplify Your Approach to Privacy
35mRevolutionizing Cyber Defense: The NIST CSF 2.0 Advantage