The fastest way to move RMF away from compliance and into the mission space is to stop treating authorization as a milestone and start treating it as a continuous engineering process. RMF shouldn’t be a side activity, it should be embedded in how a system is built, deployed, and maintained. That starts by tying every security control to a clearly defined, mission-relevant risk—and making sure senior leadership owns the decision to mitigate, transfer, or accept that risk. Care must be taken to ensure that risk ownership does not drift downward; while responsibilities can be delegated, authority cannot. Too often, lower-level individuals assume they can accept risk or bypass controls without executive awareness. That is a governance failure. Just as important, security controls must be written into engineering and development requirements as mandatory—not treated as optional guidance. When security controls are presented as negotiable, they are often deprioritized or ignored entirely under pressure to deliver. Security cannot be left to interpretation; it must be embedded as a condition of acceptance at every stage of system design and implementation.
Publishing Link
https://atarc.org/project/white-paper-modernizing-rmf-for-continuous-evidence-based-security/