NIST Risk Management Framework Training

Workshop Purpose:

Provide an overview of the NIST Risk Management Framework (RMF) for managing information security risk in organizations and systems, understand the publications that support the process, and describe how to integrate information security into an organization’s mission and business processes.

This 2-day course includes:

An overview of an organization-wide risk management programme;
The steps in the RMF;
Key roles in implementing the RMF;
NIST publications related to each step; and
Conducting a mock risk assessment, developing a mock system security plan and security assessment report.

After completing this course, participants will be able to:

Explain the importance of establishing an organization-wide risk management programme;
Describe the purpose of the RMF as an organization-wide risk management methodology and how use of the RMF facilitates an atmosphere of trust among organizations;
Understand the considerations related to each step in the RMF, including relevant NIST publications; and
Implement the RMF and develop key RMF artifacts of the process.

Location:

Department of Workforce Development, Parliament Street, Hamilton

Speaker:

Victoria Yan Pillitteri, NIST

Register at: www.gov.bm/form/cybersecurity-workshop (you will be asked for your online payment confirmation number)

Workshop Agenda:

Day One – Overview of RMF Publications
Morning – 9:00 a.m.

NIST Special Publication (SP) 800-39, Managing Information Security Risk: Organization, Mission, and Information System View
NIST SP 800-30, Guide for Conducting Risk Assessments
NIST SP 800-37 (part 1), Guide for Applying the Risk Management Framework

Lunch: 12:00 p.m. – 1:00 p.m.
Afternoon (until ~ 5:00 p.m.)

NIST SP 800-37 (part 2)
NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations
NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans

Day Two – Interactive Workshop
Morning – 9:00 a.m.

Conduct mock risk assessment
Develop mock system security plan