RMF Authorization Package Checklist: NIST SP 800-37 Documents and Review Order

An RMF authorization package connects system boundaries, control evidence, assessment findings, and remediation commitments so the authorizing official can evaluate risk.

Your RMF authorization package checklist should cover the system security plan, assessment report, plan of action and milestones (POA&M), and executive summary, with the assessment plan supporting the assessment record. NIST SP 800-37 Rev. 2 identifies the core authorization package contents and sequences the work from system preparation through authorization and continuous monitoring.

The assessment plan is essential, but it is distinct from the core package contents identified in the publication. Applicable privacy plans and privacy assessment reports also belong in the package; agency instructions determine submission formats and additional supporting material.

What belongs on an RMF authorization package checklist?

Start with the agency’s authorization instructions and the system’s agreed boundary. Then check the package against NIST SP 800-37 Rev. 2. Each document should describe the same system, control set, and assessment scope.

• System security and privacy plans: Describe the system, its environment, applicable controls, and how those controls are implemented. Privacy content may be integrated or maintained separately.
• Security and privacy assessment reports: Record the assessment results, including findings about whether controls are implemented correctly, operate as intended, and produce the desired outcome.
• POA&M: Identify planned remediation for weaknesses or deficiencies, with milestones and scheduled completion dates.
• Executive summary: Present the key information needed for the authorization decision without requiring the reader to reconstruct it from technical findings.
• Supporting assessment material: Maintain the approved assessment plan and traceable evidence. Confirm which supporting records the agency expects within the submission.

Use this as a completeness check, not a universal folder structure. An agency may require specific templates, signatures, attachments, or submission procedures. Settle those requirements before drafting so the team can focus on accurate content rather than late reformatting.

How does NIST SP 800-37 sequence RMF authorization documents?

NIST SP 800-37 Rev. 2 organizes the Risk Management Framework into Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. These steps establish dependencies, while allowing iteration when findings or system changes require earlier decisions to be revisited.

• Prepare and Categorize: Identify the system, information types, stakeholders, operating environment, and security categorization. Establish a boundary that the plans and assessment will consistently use.
• Select: Select and tailor controls, identify common controls available for inheritance, and document the planned controls in the security and privacy plans.
• Implement: Put controls into operation and update the plans to describe the actual implementation, including deviations from the planned approach.
• Assess: Select assessors, develop and approve assessment plans, assess controls, report results, conduct remediation, and prepare the POA&M for remaining weaknesses.
• Authorize: Assemble the package, analyze and determine risk, determine risk responses, and obtain the authorizing official’s decision.
• Monitor: Track changes, reassess controls as appropriate, update plans and remediation records, and report security and privacy status.

The practical dependency is straightforward: assessors need sufficiently complete implementation descriptions before they can plan meaningful assessment activities. Remediation can trigger reassessment and report updates. The authorization package should reflect those results rather than freeze the record at the first assessment.

Who reads each part of the RMF authorization package?

System owners coordinate preparation, control providers supply implementation details, and assessors document their evaluation. Reviewers may include system security staff, privacy officials, common control providers, and the authorizing official’s representatives. Titles vary by agency; document ownership and review authority should be explicit.

System security plan: What exists, and how are controls implemented?

The system security plan, or SSP, gives assessors the description they will evaluate. System owners and control implementers use it to maintain a shared record of the system. Authorization reviewers use it to understand the boundary, dependencies, and protections relevant to risk.

For each applicable control, describe the actual implementation rather than repeat the control statement. Identify who performs the activity, where it applies, and what records show it occurred. Document organization-defined parameters and distinguish system-specific, common, and hybrid controls.

For example, an account-management description should explain account approval, access review, and account removal. Supporting evidence could include approved requests, review records, and removal records. A policy alone establishes expectations; it does not demonstrate that the activity happened.

For inherited controls, identify the common control provider and the controls supplied. Confirm the system meets any conditions for inheritance and implements its share of hybrid controls. A provider’s control description does not establish that every connected system receives the same protection.

Assessment plan: What will the assessor examine, interview, and test?

The assessment plan translates scope into assessment activities. NIST SP 800-53A provides procedures and the examine, interview, and test methods for assessing security and privacy controls. The plan identifies the controls assessed, selected procedures, assessment objects, and the depth and coverage of the assessment.

Assessors develop the plan with input from the people who understand the system and its operating constraints. The authorizing official or designated representative reviews and approves assessment plans before assessment activities begin. The required assessor independence should also be established.

System owners and technical staff read the plan to arrange evidence, access, interviews, and testing conditions. Resolve scope questions here: which components are included, which controls are inherited, and which evidence supports the selected procedures. Obtain written authorization and scope before penetration testing or vulnerability testing.

Assessment report: What did the evidence establish?

The assessment report records results, not just completion of assessment activities. It should connect findings to the controls and assessment objectives evaluated, explain weaknesses or deficiencies, and identify relevant evidence. NIST SP 800-53A uses satisfied and other than satisfied determinations for assessment objectives.

Technical staff use the findings to plan corrections. System owners review their significance and proposed responses. The authorizing official and supporting reviewers use the report to understand control effectiveness and remaining risk.

Keep missing evidence distinct from evidence of a failed implementation. Explain assessment constraints rather than leaving unexplained gaps. If a correction is reassessed, preserve the original finding and the subsequent result so reviewers can follow what changed.

POA&M: What remains open, and how will it be corrected?

The POA&M turns unresolved weaknesses into tracked remediation. NIST SP 800-37 describes planned remediation actions, milestones, and scheduled completion dates. Agency instructions commonly add fields for ownership, resources, status, and supporting references.

Give each entry a clear connection to the relevant finding and control. Describe the corrective action precisely enough that another reviewer can determine whether it is complete. Identify dependencies, such as a shared service change, that could affect progress.

Remediation owners use the POA&M to execute the plan. System owners track progress and resource needs. Authorization reviewers evaluate the proposed treatment of remaining weaknesses. Close entries using evidence of completed correction and any verification required by the agency, rather than a status change alone.

Executive summary: What decision does the package support?

Write the executive summary after reconciling the plans, report, and POA&M. Highlight the system’s purpose, assessment results, significant remaining risks, and proposed responses. Keep technical references available so reviewers can move from the summary to the supporting record.

The government authorizing official makes the authorization decision. The package supplies the information for that decision; a completed assessment or a remediation schedule does not itself constitute authorization.

How do you check an RMF package before submission?

Run a cross-document review before routing the package. Start with consistency, then trace findings and remediation, then verify approvals. Use agency requirements to resolve any differences in format or required supporting records.

• Match the system name, boundary, categorization, and control set across the plans, assessment scope, and reports.
• Confirm implementation descriptions reflect the assessed system, including changes made during remediation.
• Trace assessment results to applicable controls, procedures, and evidence. Explain exclusions and constraints.
• Reconcile unresolved findings with POA&M entries or other documented risk responses required by the agency.
• Verify that inherited controls have identified providers and supporting assessment or authorization information.
• Check dates, versions, required approvals, and the executive summary against the final package.

Assign discrepancies to named owners. Resolve contradictions before submission, especially cases where the SSP describes a control as implemented but the report shows an unresolved deficiency. Both records can remain accurate if the implementation limits and remediation status are clearly explained.

How Seven Vector helps

We support RMF preparation and Security Control Assessment through Assess, then Build, then Operate. We assess documentation and evidence gaps, help build accurate control descriptions and remediation plans, and support ongoing assessment and record updates. We organize the work around your system boundary and agency requirements.

Book a 30-minute initial consultation to discuss your RMF authorization package and the next steps for preparation or assessment.

Questions

Is the assessment plan a required part of the authorization package?

NIST SP 800-37 requires assessment planning, but its core authorization package contents identify the executive summary, security and privacy plans, assessment reports, and POA&M. The assessment plan supports that record. Follow agency instructions on whether to submit it as an attachment.

Can a system receive authorization with open POA&M items?

Open findings do not automatically determine the authorization outcome. The government authorizing official evaluates risk and decides whether operation is acceptable, including any terms and conditions. A POA&M documents planned remediation; it does not grant permission to operate.

What is the difference between NIST SP 800-37 and NIST SP 800-53A?

NIST SP 800-37 describes the RMF process, including assessment and authorization. NIST SP 800-53A provides procedures for assessing controls. Use the former to sequence the work and the latter to develop assessment activities for the applicable controls.

Does the package stay unchanged after authorization?

The Monitor step includes updating security and privacy plans, assessment reports, and remediation records as needed. System changes, new findings, and completed corrections can affect those records. Agency monitoring and authorization requirements determine the review and reporting process.

Call (888) 753-6725. Calls answered 24/7, 365 days a year.