NIST RMF agent skills
7 skills relate to NIST RMF. The tag says which framework a skill relates to; the skills contain no text from it.
The NIST Risk Management Framework (SP 800-37) takes a system through seven steps: prepare, categorise, select, implement, assess, authorise and monitor. An authorising official decides whether the remaining risk is acceptable and signs the authorisation. These skills draft the categorisation, the plan statements and the plan of action and milestones for that decision.
7 skills tagged NIST RMF
- GRC setup reviewThe 10 grcskills that fit your setup, an audit of what is broken, duplicated or missing, and a 30-day plan, written to files.
- Plan of action and milestones draftA plan of action and milestones from your findings and scans: one row per weakness, dated milestones, owners, and every vague or overdue item flagged.
- Risk acceptance memoA one-page risk acceptance record: the risk, options considered, compensating measures, conditions, expiry and a signature block for the right authority.
- Risk method draftingA risk assessment method you can repeat: likelihood and impact scales, risk appetite, acceptance criteria and who may accept what.
- Risk register first passA first risk register of 20 to 40 company-specific scenarios, drafted from your own material, with owners and scores to confirm.
- SSP control implementation statementsSystem security plan statements drafted from your real evidence, per control id: who, what, how, where and how often, with every unproven claim flagged.
- System categorization first passA draft system categorization: boundary, information types, impact levels with reasons, the high-water mark and what the official decides.