Automating the RMF: A Necessary Evolution

Global enterprises face disproportionately complex and inflexible risk management strategies when it comes to compliance with cybersecurity frameworks. The manual tasks associated with the scope of security compliance are labor intensive and often executed inaccurately. Adopting a manual risk management framework (RMF) reduces output, increases the chance of mistakes, and restricts the flexibility an organization needs today. On the contrary, automation can greatly alleviate the workload of manual processes involved in undertaking risk (e.g., documenting security controls, updating system security plans [SSPs], conducting vulnerability scans) as they are often too slow, full of errors, and resource-intensive.

Automation allows organizations to precisely and promptly execute compliance actions, which allows organizations to identify misconfigurations, close security gaps, and respond to threats before they take over critical systems. Automated systems enable personnel in charge of security to monitor the many system security frameworks in active, dispersed environments, closing gaps and satisfying various security requirements. Tools such as OpenRMF, RAFT, RMF-O, Xacta, and Tenable.io offer automation capabilities, enabling organizations to more easily comply with international standards such as the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) standard 27001 and the EU General Data Protection Regulation (GDPR).¹ Through the integration of automation into RMFs, organizations can enhance their security posture and reporting accuracy while reducing administrative burden and overhead.²

Drawbacks of Manual RMFs

Seemingly minor vulnerabilities can lead to catastrophic consequences, making cybersecurity an area of critical importance. Manual RMFs appear effective on paper, but in practice, their labor-intensive workflows have rendered them incapable of adapting to evolving cyberthreats. Key issues impacting organizations that are still dependent on manual RMFs include:

• Excessive time consumption—Tasks such as capturing sensitive documents for security and monitoring how controls are inherited can be automated to save effort, time, and employees. Also termed as inefficient use of time, manual efforts to perform these tasks can result in a significant delay in authorizations and increased emphasis on secondary breach remediation services.
• Poor scalability—RMF processes that are purely manual have a particularly challenging time at the administrative level, particularly within systems where the networks of the enterprise grow in intricacy. Security teams should integrate automated procedures across systems to streamline processes.
• Lack of real-time monitoring—Manual processes react to changes rather than anticipating and preemptively addressing them. Organizational threats or misconfigurations will always result in security gaps when monitoring is not automated, and the delays will ultimately cause an increase in intrusion dwell times.
• Audit and reporting inefficiency—The time needed to create custom compliance reports or control documents makes them less reliable, which ultimately results in lower quality audits. This stagnates the overall pace of audits, as well as readiness levels during cybersecurity inspections.
• Limited integration—Manual workflows are the least adaptable to newer technologies, including vulnerability scanners, security information and event management (SIEM) systems, and ticketing software. This one-dimensional view means that results cannot be integrated and responses to risk cannot be coordinated promptly.

These challenges erode organizational responsiveness and resilience to the evolving speed of cyberthreats. Manual processes not only become a compliance bottleneck but a mission assurance problem that is increasingly concerning to government and commercial sectors.

Automation Tools: Benefits and Barriers

Automation tools enable precise compliance with security requirements and help streamline processes and enhance efficiency. Through automation, teams can address intricate security issues, reduce manual work, and fortify organizational security.³ These tools enable the automation of RMF processes, allowing enterprises to easily scale compliance monitoring against the US National Institute of Standards and Technology (NIST), apply patch updates with increased speed, and respond to new threats with greater agility.⁴ The automation of cybersecurity processes offers unmatched benefits but also poses several problems. Some of the factors that lead to opposition are organizational culture, complex integration procedures, and the need for employee training. The effective employment of automation tools involves the detailed planning of processes, proper training of personnel, and advanced preparation of plans aimed at achieving enterprise goals.

Real-World Automation Success Stories

Several case studies demonstrate how enterprises from various industries have adopted automated systems to enhance compliance, lower operational costs, and refine security measures.

Case Study 1: A Financial Institution Improves PCI DSS Compliance
A financial institution attempted to improve an inefficient PCI DSS compliance program. They worked with Comsec, a QSA company, to revise their compliance architecture.⁵ Integrating security into core business processes enabled a shift from a reactive compliance approach to proactive risk management, which substantially reduced vulnerability to data breaches, financial fraud, and regulatory scrutiny while improving the institution’s overall security posture.⁶

Case Study 2: HIPAA Compliance Strengthened by a Healthcare Provider
A healthcare company strategically advanced its security platform by installing Tenable.sc, with the goal of continuous monitoring aligned with the US Health Information Portability and Accountability Act (HIPAA) and PCI DSS compliance requirements.⁷ The solution featured user-defined templates and dashboards, in addition to passive vulnerability scanning, which augmented active assessments of patient data, thereby enhancing audit readiness.⁸

Case Study 3: Enhanced Cybersecurity for Government Health Agency
A government health agency worked with Tenable to enhance its cybersecurity posture and protect sensitive patient data.⁹ Employing Tenable.io, the agency gained an aggregated view of risk, streamlined incident management workflows, and improved the efficacy of the security resources, thus fulfilling the organizational objectives of advancing health outcomes.¹⁰

Practical Strategies for Implementing Automation in RMF Processes

Organizations can add automation to their RMF activities through several practical steps:

1. Evaluate processes for automation potential. Organizations looking to implement automation should begin by exploring existing RMF workflows to determine activities that involve repetitive manual processes, which may include:
   • Vulnerability scanning and report generation
     • Automates the addressing of various vulnerabilities present within different assets
     • Helps meet reporting requirements for NIST 800-53 or US Department of Defense (DoD) security technical implementation guides (STIGs)¹¹
     • Generates compliance reports and assists in the updating of plugins and scheduling of scans, which enables the elimination of manual activities
   • Alert generation and monitoring
     • Provides real time cross-reference of various logs in an attempt to analyze for dubious activity
     • Provides visibility into integrated security data, which assists in responding to incidents
     • Automated alerts aid in enhancing work fatigue experienced by analysts
   • Documenting control of security procedures
     • Facilitates the development of various documents such as SSPs, security assessment reports (SARs), and plans of action and milestones (POA&Ms)
     • Fills fields using application programming interfaces (APIs), diminishing the possibility of errors
     • Provides control implementation monitoring, which enables tracking of version history
2. Choose automation tools that are appropriate for use with the selected framework. Select automation tools that help facilitate compliance. Strong automation support for control implementation, vulnerability management, and compliance reporting automation is available in tools such as OpenRMF, Xacta, and Tenable.io.
3. Integrate the automation tool(s) into systems. Ensure that secure API connections are created with platforms such as Splunk, Microsoft Sentinel, or Amazon Web Services (AWS) Security Hub to add value to data and enhance the visibility of security assessments.
4. Take advantage of automated reporting and documentation. Through the implementation of automation tools, the accuracy of documents can be guaranteed. This is because SSPs, control assessments, and audit-ready reports are generated in real time, leaving little room for mistakes to occur. This mitigates the likelihood of errors, which occur more frequently during manual document updates.
5. Establish best practices and train the applicable personnel. Train personnel from the IT and IS departments so that others in the organization understand the application of automation and how to solve problems such as automation integration issues with legacy systems, data and alert misconfiguration, ill-defined ownership, etc. Responsibility for managing automated controls and tools must be determined collaboratively between organizational decision makers.

Role-Based Automation Guidance

Automation improves the productivity of IT/IS professionals by alleviating burdens associated with traditional RMF processes and empowering certain roles (figure 1). Different roles encapsulate different steps of the RMF life cycle, from system preparation to continuous monitoring. In other words, each role subdivides the entire process into manageable subtasks. Integrating real-time data from security tools capable of auto-documentation, as well as central control evidence for documentation, enables more active delegation to stakeholders. Thus, putting each role into position enables them to make improvements in strategic oversight and decision making as opposed to spending time on manual administrative tasks. Organizations become more nimble, accountable, and resilient to change following a clear role definition in tandem with integrated automation tools.

Strengthening Compliance with Automation

Compliance has become a pillar of enterprise security programs. Healthcare, finance, and energy organizations have come to recognize that they must conduct operations while adhering to security frameworks. To this end, organizations internationally comply with numerous frameworks and regulations, including the US Federal Risk and Authorization Management Program (FedRAMP), US Federal Information Security Modernization Act (FISMA), US HIPAA, GDPR, and international standards and frameworks such as ISO/IEC 27001 and COBIT^®.

The practice of manual compliance, especially regarding documentation and monitoring, can burden security teams in complex IT ecosystems with diverse technologies. However, these challenges can be addressed through automation, which has the potential to cut down on the time taken to complete a compliance evaluation and improve documentation, audit preparation, and compliance accuracy. Tools such as OpenRMF and RMF-O assist organizations in accomplishing compliance objectives through:

• Automated control mapping—These tools assist in automating the assignment of relevant security controls to assets within the organization, thereby facilitating compliance with NIST 800-53, ISO/IEC 27001, and CIS Benchmarks.¹²
• Vulnerability identification and reporting—Automated configuration scanning tools, such as the Assured Compliance and Assessment Solution (ACAS) and Tenable.io, assess system configurations on a continuous basis, identify system vulnerabilities, and compile detailed reports for monitoring compliance.
• Continuous monitoring—Automated monitoring systems create alerts in real time whenever security controls fall below their predefined baselines. Incorporation of these tools by security teams into enterprise environments enhances proactive visibility and incident response.

Automation improves documentation processes through the uniform capture of SSPs, policies, and procedures. Automated workflows eliminate unnecessary documentation tasks and ensure that all compliance artifacts are relevant to an audit. This approach allows organizations to remain compliant while mitigating risk associated with security breaches or audits.

Comparison of Automation Tools

Figure 2 analyzes three representative RMF automation tools—OpenRMF, RAFT, and RMF-O—with respect to their level of automation, scalability, and cost efficiency. These tools were selected to exemplify multiple viewpoints regarding the differing approaches and levels of maturity in automating RMF workflows. Each tool captures different priorities of use cases. The scores were developed by the author based on a synthesis of qualitative feedback from 10 expert participants. Each tool was evaluated across several criteria, and the scores represent a weighted average of expert consensus combined with researcher judgment to highlight relative effectiveness. OpenRMF is most beneficial in acts that are over-compliant and require a minimal touch user interface as opposed to completion with forms. RAFT supports more hands-on, detail-oriented control and customization, catering to constituents who actively wish to engage with the RMF throughout its entire life cycle. RMF-O has clear advantages for AI-centric systems where proactively managed risk, analytics, and rapid scalability are critical. The figure demonstrates that RMF-O achieves the highest scores overall, which suggests its wide applicability in extensive or intricate operations. OpenRMF comes next, following strong automation but less cost effectiveness, with RAFT behind, scoring lower and suggesting better value in more specialized or niche settings. The comparison reveals the need to assess automation tools guided outside of feature inventories and instead focus more on alignment with the scale of the mission, budget, and preferred operational philosophy.¹³

The Automated Security Advantage

The increasing scope of digital business necessitates that organizational security staff protect their complex environments that are subject to many regulations and require multilayered compliance. Problems of greater complexity can be managed with implemented automated technology, which safeguards sensitive information while achieving compliance through a digitized and data-driven policy. OpenRMF, Xacta, and Tenable.io automation tools allow for the timely identification of—and response to—risk. These tools enable enterprises to merge security frameworks with ISO/IEC 27001, COBIT, and GDPR for proactive risk management. Automated processes enable rapid response to detected vulnerabilities through the employment of continuous monitoring. IS/IT automation platforms allow organizations to dedicate more time to strategic improvement by eliminating administrative functions such as reporting, compliance documentation, and security assessments. Automation tools can also produce detailed reports that assist in ongoing compliance maintenance and audit readiness. Overall, conducting operations with automation enables minimal dependency on a single person, mitigates human errors, guarantees maximum protection, and enhances the operational effectiveness and competence of the organization.

Conclusion

Enterprises in specialized industries such as healthcare, finance, or government can use automation to assist in clerical tasks and increase security. Organizations leveraging automation technologies will see improved response times, quicker decision-making capabilities, and heightened awareness of the ever-changing risk landscape, thus outpacing competitors. In the face of more advanced cybersecurity threats, services in need of extra security and protection must implement automation. Automation tools can enable enterprises to proactively mitigate threats, enhance security posture, and maintain competitiveness in a dynamically evolving digital world.

Endnotes

¹ International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection—information security management systems—requirements, 2022, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [GDPR]) (Text with EEA relevance)
² McDermott, K.; “NAVWAR Continues to Enhance Risk Management Framework (RMF) Factory,” DVIDS, 19 October 2023
³ IntelliDyne, RMF Automation With RMF Orchestrator IntelliDyne Solution Brief, 2024
⁴ National Institute of Standards and Technology, “Cybersecurity,” USA
⁵ Comsec, “PCI DSS Optimization—Comsec's Award-Winning PCI DSS Case Study!” 
⁶ IntelliDyne, “RMF Automation with RMF”
⁷ Tenable, “St. Elizabeth Healthcare Case Study,” US Department of Health and Human Services, “Summary of the HIPAA Privacy Rule,” USA 
⁸ Comsec, “PCI DSS Optimization”
⁹ Tenable, “A Government Health Agency Cybersecurity Case Study” 
¹⁰ Tenable, “A Government Health Agency”
¹¹ National Institute of Standards and Technology (NIST), NIST SP 800-53 Rev. 5—Security and Privacy Controls for Information Systems and Organizations, USA, September 2020, DoD Cyber Exchange, “Security Technical Implementation Guides (STIGs),” USA
¹² NIST, NIST SP 800-53; ISO/IEC, ISO/IEC 27001; Center for Internet Security (CIS), “CIS Benchmarks List” 
¹³ IntelliDyne, “RMF Automation with RMF”

DAVIDA MARIA FUTCH | D.SC, CDPSE, ACAS, CISCO, COMPTIA SECURITY+

Is a senior cybersecurity analyst and the lead cybersecurity subject matter expert at Strategic Operational Solutions. She leads the effort to achieve cybersecurity compliance at 13 US Air Force bases and has simultaneously served in the US Air Force Reserves as a knowledge operations manager. Futch has worked in both industries for more than a decade, with the last seven years focusing on computer network engineering. She has safeguarded and scrutinized some of the most sophisticated IT infrastructures in the world. Futch has a top-secret clearance, has assisted in the cybersecurity efforts of the US Navy enterprise resource planning (ERP) project, and has worked in senior cybersecurity positions at Falconwood Incorporated, Crest Security Assurance, and ICF International.