Table E-1

TABLE E-1: PREPARE TASKS, RESPONSIBILITIES, AND SUPPORTING ROLES


RMF TASKS	PRIMARY RESPONSIBILITY	SUPPORTING ROLES
Organization Level
TASK P-1 Risk Management Roles Identify and assign individuals to specific roles associated with security and privacy risk management.	Head of Agency Chief Information Officer Senior Agency Official for Privacy	Authorizing Official or Authorizing Official Designated Representative Senior Accountable Official for Risk Management or Risk Executive (Function) Senior Agency Information Security Officer
TASK P-2 Risk Management Strategy Establish a risk management strategy for the organization that includes a determination of risk tolerance.	Head of Agency	Senior Accountable Official for Risk Management or Risk Executive (Function) Chief Information Officer Senior Agency Information Security Officer Senior Agency Official for Privacy
TASK P-3 Risk Assessment—Organization Assess organization-wide security and privacy risk and update the risk assessment results on an ongoing basis.	Senior Accountable Official for Risk Management or Risk Executive (Function) Senior Agency Information Security Officer Senior Agency Official for Privacy	Chief Information Officer Authorizing Official or Authorizing Official Designated Representative Mission or Business Owner
TASK P-4 Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (Optional) Establish, document, and publish organizationally-tailored control baselines and/or Cybersecurity Framework Profiles.	Mission or Business Owner Senior Accountable Official for Risk Management or Risk Executive (Function)	Chief Information Officer Authorizing Official or Authorizing Official Designated Representative Senior Agency Information Security Officer Senior Agency Official for Privacy
TASK P-5 Common Control Identification Identify, document, and publish organization-wide common controls that are available for inheritance by organizational systems.	Senior Agency Information Security Officer Senior Agency Official for Privacy	Mission or Business Owner Senior Accountable Official for Risk Management or Risk Executive (Function) Chief Information Officer Authorizing Official or Authorizing Official Designated Representative Common Control Provider System Owner
TASK P-6 Impact-Level Prioritization (Optional) Prioritize organizational systems with the same impact level.	Senior Accountable Official for Risk Management or Risk Executive (Function)	Senior Agency Information Security Officer Senior Agency Official for Privacy Mission or Business Owner System Owner Chief Information Officer Authorizing Official or Authorizing Official Designated Representative
TASK P-7 Continuous Monitoring Strategy—Organization Develop and implement an organization-wide strategy for continuously monitoring control effectiveness.	Senior Accountable Official for Risk Management or Risk Executive (Function)	Chief Information Officer Senior Agency Information Security Officer Senior Agency Official for Privacy Mission or Business Owner System Owner Authorizing Official or Authorizing Official Designated Representative
System Level
TASK P-8 Mission or Business Focus Identify the missions, business functions, and mission/business processes that the system is intended to support.	Mission or Business Owner	Authorizing Official or Authorizing Official Designated Representative System Owner Information Owner or Steward Chief Information Officer Senior Agency Information Security Officer Senior Agency Official for Privacy
TASK P-9 System Stakeholders Identify stakeholders who have an interest in the design, development, implementation, assessment, operation, maintenance, or disposal of the system.	Mission or Business Owner System Owner	Chief Information Officer Authorizing Official or Authorizing Official Designated Representative Information Owner or Steward Senior Agency Information Security Officer Senior Agency Official for Privacy Chief Acquisition Officer
TASK P-10 Asset Identification Identify assets that require protection.	System Owner	Authorizing Official or Authorizing Official Designated Representative Mission or Business Owner Information Owner or Steward Senior Agency Information Security Officer Senior Agency Official for Privacy System Administrator
TASK P-11 Authorization Boundary Determine the authorization boundary of the system.	Authorizing Official	Chief Information Officer Mission or Business Owner System Owner Senior Agency Information Security Officer Senior Agency Official for Privacy Enterprise Architect
TASK P-12 Information Types Identify the types of information to be processed, stored, and transmitted by the system.	System Owner Information Owner or Steward	System Security Officer System Privacy Officer Mission or Business Owner
TASK P-13 Information Life Cycle Identify and understand all stages of the information life cycle for each information type processed, stored, or transmitted by the system.	Senior Agency Official for Privacy System Owner Information Owner or Steward	Chief Information Officer Mission or Business Owner Security Architect Privacy Architect Enterprise Architect Systems Security Engineer Privacy Engineer
TASK P-14 Risk Assessment—System Conduct a system-level risk assessment and update the risk assessment results on an ongoing basis.	System Owner System Security Officer System Privacy Officer	Senior Accountable Official for Risk Management or Risk Executive (Function) Authorizing Official or Authorizing Official Designated Representative Mission or Business Owner Information Owner or Steward System Security Officer
TASK P-15 Requirements Definition Define the security and privacy requirements for the system and the environment of operation.	Mission or Business Owner System Owner Information Owner or Steward System Privacy Officer	Authorizing Official or Authorizing Official Designated Representative Senior Agency Information Security Officer Senior Agency Official for Privacy System Security Officer Chief Acquisition Officer Security Architect Privacy Architect Enterprise Architect
TASK P-16 Enterprise Architecture Determine the placement of the system within the enterprise architecture.	Mission or Business Owner Enterprise Architect Security Architect Privacy Architect	Chief Information Officer Authorizing Official or Authorizing Official Designated Representative Senior Agency Information Security Officer Senior Agency Official for Privacy System Owner Information Owner or Steward
TASK P-17 Requirements Allocation Allocate security and privacy requirements to the system and to the environment of operation.	Security Architect Privacy Architect System Security Officer System Privacy Officer	Chief Information Officer Authorizing Official or Authorizing Official Designated Representative Mission or Business Owner Senior Agency Information Security Officer Senior Agency Official for Privacy System Owner
TASK P-18 System Registration Register the system with organizational program or management offices.	SystemOwner	Mission or Business Owner Chief Information Officer System Security Officer System Privacy Officer