CISSP Study Plan – Day 29 of 55 | Understanding the Risk Management Framework (RMF)
- Luke Ahmed
- Oct 4
- 3 min read
Updated: Oct 5
"It's been 5 years since I wrote that book, so good to see it in your hands. The ultimate measure of its success will be the completion of your CISSP."– Luke Ahmed
Today is Day 29 of Yihenew’s CISSP study plan, focusing on the Risk Management Framework (RMF) — one of the most structured approaches to managing system risk and ensuring security decisions are traceable, measurable, and justifiable.
Key Areas Covered:
Purpose of RMF — to integrate security and risk management activities into the system development lifecycle.
NIST SP 800-37 — defines the RMF for federal systems, but the process applies to all organizations that value structured governance.
Six Steps of RMF:
Categorize — determine system impact (low, moderate, high).
Select — choose security controls based on impact level (from NIST SP 800-53).
Implement — put the selected controls in place.
Assess — evaluate whether controls are implemented correctly and effectively.
Authorize — management formally accepts system risk (the “go live” decision).
Monitor — continuously track control performance and respond to changes.
Roles — Authorizing Official (AO), Information System Owner (ISO), Security Control Assessor (SCA).
CISSP Exam Tie-In — focus on sequence and accountability. The exam often asks who approves risk or when monitoring occurs in the cycle.
In this CISSP study plan session, Yihenew explored how RMF connects technical controls to management responsibility — showing that risk decisions are never one-time events but part of a continuous cycle.
Quick CISSP Practice Question
In the RMF, which role is responsible for formally accepting system risk and granting authorization to operate (ATO)?
A. Information System Owner (ISO)
B. Authorizing Official (AO)
C. Security Control Assessor (SCA)
D. System Administrator
✅ Correct Answer: B. Authorizing Official (AO)
Explanation:
The Authorizing Official makes the final call to accept or reject residual risk and authorize operation.
The ISO owns and manages the system, while the SCA evaluates controls and provides recommendations.
CISSP questions test your grasp of risk accountability, not control mechanics.
Think Like a Manager: The RMF isn’t about paperwork — it’s about who owns the decision to live with risk. CISSP will always reward the answer that reflects accountability at the management level, not technical execution.
👉 Can you take the Yani Challenge?
55 days of consistent CISSP prep, tackling one domain at a time, using only the resources below:
Course
Luke's CISSP Course (2 months access, $89.98)
One-to-one Zoom sessions with Luke Ahmed (2 weeks before exam)
Books, Notes, and Practice Questions
All-In-One Study Guide by Shon Harris (Around $45)
Sybex 10th Edition (Around $52.55)
Total Cost: approxiamately $250 depending on your geographic location. Yani is located in East Africa.
📚 Study Plan (55 Days of Dedication):
- Weekdays: 2–3 hours of focused study—late nights and early mornings (5 AM).
- Weekends: 5–6 hours of deep study sessions.
Pass CISSP in first attempt within 100 questions.
Yani's biggest expense was his time, committment, consistency, and dedication! It was worth it because he passed first attempt in 100 questions using the above resources only.
If Yihenew could do it, so can you.
All the best Future CISSP. You can feel free to contact me anytime as well.
Thank you.
Luke Ahmed
