Module 2 RMF Fundamentals and Categorization
What you will be able to do
- Name the seven RMF steps in NIST SP 800-37 and the artifact each produces.
- Describe an authorization boundary and decide what is inside it for a simple system.
- Identify information types and assign impact levels under FIPS 199, applying the high-water mark.
- Explain why categorization is based on impact, not on threat.
- State when a privacy threshold analysis and privacy impact assessment are needed.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. The Risk Management Framework at a Glance · 35 min Completed
- 2. Preparing a System and Drawing Its Boundary · 40 min Completed
- 3. Categorizing a System · 50 min Completed
- 4. Impact, Not Threat: A Recategorization Case Study · 35 min Completed
- 5. The Privacy Threshold · 30 min Completed
Practice and quiz
- Practical exercise: Categorize TreasuryFlow and Describe Its Boundary
- Module quiz (10 questions, pass mark 80 percent)
Overview
This module introduces the Risk Management Framework (RMF) and takes you through its first two steps in practice: preparing a system and categorizing it. These steps decide what "the system" is and how much it matters. Everything after them is sized by the answers.
From this module on, TreasuryFlow is your system. Each module's exercise produces a piece of its authorization package, and the capstone asks you to repeat the whole chain on a system you have not seen.
Builds on
- Module 1, Lesson 1: the chain from statute to system. This module starts at the FIPS 199 link.
- Module 1, Lesson 3: the roles. Here you see which role approves a categorization and who decides privacy questions.
- Module 0, Lessons 1 and 6: inventories and boundary diagrams.
- Module 0, Lesson 5: confidentiality, integrity, and availability, which now become ratings.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | The Risk Management Framework at a Glance | 35 min | Adapted from existing material |
| 2 | Preparing a System and Drawing Its Boundary | 40 min | New |
| 3 | Categorizing a System | 50 min | Adapted |
| 4 | Impact, Not Threat: A Recategorization Case Study | 35 min | Adapted (case rebuilt on a fictional system) |
| 5 | The Privacy Threshold | 30 min | Adapted |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| FIPS 199 | Binding standard | Requires categorization of every federal system |
| FIPS 200 | Binding standard | Sets the high-water mark rule and minimum requirements |
| E-Government Act of 2002, Section 208 | Binding statute | Requires privacy impact assessments |
| Privacy Act of 1974 | Binding statute | Governs systems of records and their notices |
| OMB Circular A-130 | Binding policy | Requires agencies to apply the RMF and run privacy programs |
| NIST SP 800-37 | Guidance, required in practice | The RMF process; applied through Circular A-130 |
| NIST SP 800-60 | Guidance | Provisional impact levels are recommendations that may be adjusted with rationale |
| NIST SP 800-18, SP 800-30, SP 800-47, SP 800-82, SP 800-122 | Guidance | Supporting publications |
| Privacy threshold analysis | Agency practice | Not required by statute as such; agency policy normally requires it |
| Reauthorization every three years | Agency policy where it applies | Federal policy also permits ongoing authorization |
Module summary
- The RMF has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. Each produces a document the next one needs.
- The authorization boundary is drawn by management control: same owner, same administration, same purpose, similar sensitivity.
- Categorize by information types and consequence. Rate each objective, adjust with written reasons, and take the highest value.
- Categorization asks how bad a loss would be, never how likely. Threat belongs in the risk assessment.
- Privacy obligations follow the presence of personal information, not the impact level, and the privacy office decides them. "No personal information" needs a signed determination.
What comes next
Module 3 takes TreasuryFlow's Moderate rating and privacy determination and turns them into a set of controls: reading the catalog, choosing the baseline, and tailoring it.
Last reviewed 2026-11-11. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.