Control selection and RMF operating procedure

Control selection and RMF operating procedure

CO-01 — Control implementation record

CO-02 — Prepare

The programme owner establishes the organisational context for security and privacy risk decisions. Preparation identifies roles, stakeholders, risk strategy, common controls, information sources and the system’s relationship to mission or business processes. The system owner confirms the boundary, constituent services, information types, users, operating environment and dependencies. The resulting description is maintained in the system plan and used consistently in control selection and assessment.

The owner identifies the authority responsible for accepting system risk and the people responsible for assessment and common-control provision. Preparation includes the resources and records needed to perform the subsequent steps. Existing policies and assessments are reused where their scope, version and evidence remain applicable. Reuse does not imply that an assessment of one system automatically covers another system.

CO-03 — Categorise

The owner determines the potential effects of loss of confidentiality, integrity and availability for the system and the information it processes. The basis, information types, stakeholders consulted and rationale are recorded. Where a mandated categorisation method applies, the record identifies that method and its governing requirement. Elsewhere, the organisation uses its approved impact criteria and clearly labels the result as its own categorisation.

Privacy risks to individuals are also considered and are not assumed to be fully expressed by information-security impact categories. The owner reviews whether boundaries hide a shared dependency or transfer consequences to another party. The decision authority confirms the categorisation and the conditions that would require it to be reconsidered.

CO-04 — Select

The control owner selects controls to address applicable requirements and risks. Selection identifies the baseline, profile or other starting point where one is used, and records additions, exclusions, enhancements and organisation-defined parameters. A reference to an entire control family is not a completed selection. The record identifies the actual control and the requirements it is intended to satisfy.

SP 800-53 Rev. 5 provides the common control identifiers. Local controls remain permitted where the catalogue does not express the needed capability. A local control has its own identifier, objective and assessment method, with any partial relationship to SP 800-53 recorded. CSF outcomes, SSDF practices and systems engineering processes retain their original references alongside the control relationship; a crosswalk is not treated as proof that the requirements are identical.

CO-05 — Implement

The assigned owner implements the selected control and records how it operates in the actual system. The description identifies components, configuration, procedures, responsibilities and evidence. Common controls identify their provider and the responsibilities that remain with the system owner. Hybrid controls distinguish the shared element from the system-specific work. Provider assurance is checked for scope, period, exclusions and customer obligations.

Implementation gaps are recorded as work with owners and target dates. The system plan distinguishes planned, partially implemented and operating controls. Changes to selected controls follow the configuration and risk procedures. Implementation descriptions are sufficiently concrete that another person can identify the mechanism or activity and locate the evidence without relying solely on the implementer’s recollection.

CO-06 — Assess

The assessor prepares an assessment plan stating the controls, objectives, methods, scope, depth, coverage and evidence required. Examination, interview and testing are selected according to the assurance need. NIST SP 800-53A assessment objectives can inform the plan, with tailoring and local additions recorded. The assessor confirms the exact system version and operating period covered.

Results identify satisfied objectives, deficiencies and limitations. Missing evidence, untested conditions and excluded components are visible. The owner prepares corrective actions and updates the risk assessment. Assessment evidence remains separate from the decision to accept the resulting risk. The reviewer’s independence and any reliance on self-assessment are recorded in the plan.

CO-07 — Authorise and monitor

The designated authority receives the system plan, assessment results, outstanding action plan and relevant risk information. The decision states whether operation or the proposed change is authorised, the scope and conditions, responsibilities, and review or expiry arrangements. The organisation’s decision is described as a formal federal authorisation only where that specific process actually applies.

The owner monitors controls, system changes and risk conditions through the schedule and trigger register. Monitoring identifies whether implementation remains current and whether the control continues to achieve its objective. Results update the system plan, risk register, assessment records and corrective actions. Material changes are referred to the authority when they affect the basis of the existing decision. Continuous monitoring is planned observation and response; the term does not establish that every control is tested continuously.