Passo Prepare do NIST Risk Management Framework (SP 800-37): o sistema e as missões que apoia, as partes interessadas e as funções RMF, a fronteira de autorização inicial, a tolerância ao risco e as decisões necessárias antes da categorização.
Conteúdo
1. Sistema e missões
2. Funções RMF
3. Fronteira de autorização inicial
4. Tolerância ao risco e restrições
5. Decisões necessárias
O que indica
System name — The system to be authorized.
System description — Purpose, users, main components and interconnections.
Missions and business functions supported
Stakeholders
Authorizing Official (role) — The senior official who will accept the risk.
System owner (role)
Control assessor
— Who assesses the controls, independent where required.
Authorization boundary — The components, interconnections and locations inside it, and what stays out.
Constraints and risk tolerance — Legal, contractual, budget, tolerance: one per entry.
Roles and owners — Who is responsible for which area. Owners in the result are taken from here; where no role covers an area, the owner is left for you to fill.
Additional context — Anything the service should take into account.
Title — As it will appear on the result.
Author — Shown as the author of the deliverable; never filled in by the AI.
Sections, in order — The template's sections are proposed, one per line in order: drag to reorder, rename, remove or add.
