scope:

Purpose:

In accordance with the authority in DoD Directive (DoDD) 5144.02, this issuance:

• Establishes the cybersecurity Risk Management Framework (RMF) for DoD Systems (referred to in this issuance as "the RMF") and establishes policy, assigns responsibilities, and prescribes procedures for executing and maintaining the RMF.

• Establishes and applies an integrated enterprise-wide decision structure for the RMF that includes and integrates DoD mission areas (MAs) pursuant to DoDD 8115.01 and the governance process prescribed in this issuance.

• Provides guidance on reciprocity of system authorization decisions for the DoD in coordination with other Federal agencies.

• Authorizes and designates the RMF Technical Advisory Group (TAG) as the body responsible for developing and publishing RMF implementation guidance.