Stop guessing what comes next. All 7 RMF steps broken into 100+ concrete tasks — the checklist the government never gives you.
NIST SP 800-37 Rev 2 · NIST SP 800-53 Rev 5 · Excel (.xlsx) · Mac, Windows & Google Sheets · Free updates for life
The government doesn’t hand you a checklist
Most ISSOs learn RMF by doing it — which means missing steps, getting caught by SCAs, and scrambling before authorization deadlines. Every package becomes a game of “what did I forget this time?”
I got tired of that. So I built the checklist I wish someone had handed me — and refined it across real DoD ATO packages.
What’s inside
- 7 step-by-step tabs — Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor
- 100+ specific tasks with exact NIST SP 800-37 Rev 2 task references (P-1 through M-7) and NIST SP 800-53 Rev 5 control citations
- Live dashboard showing your ATO completion percentage
- Status dropdowns — Complete / In Progress / Not Started / Blocked / N/A
- Responsible party, due date, and evidence columns
- 22-document NIST reference sheet
Who this is for
- New ISSOs who want to understand the full RMF process end-to-end
- ISSOs managing their first ATO who don’t want to miss a task
- Seasoned ISSOs who want a cleaner way to track progress
- Anyone supporting multiple systems who needs consistent documentation
One-time purchase · No subscription
$27
Excel (.xlsx) · Works on Mac, Windows, and Google Sheets
Instant download after purchase · Free updates for life
Frequently asked questions
Is it current? I heard there is a Rev 5.
Yes. Two different NIST documents are involved. NIST SP 800-37 Rev 2 is the current version of the Risk Management Framework itself (the 7 steps and their tasks); there is no Rev 3. NIST SP 800-53 Rev 5 (Release 5.2.0) is the current control catalog you select controls from in Step 3. This checklist follows 800-37 Rev 2 for the process and cites 800-53 Rev 5 for the controls. When NIST publishes a new revision of either, the checklist is updated and you get it free.
Does this work for DoD systems?
Yes. It follows NIST SP 800-37 Rev 2 and is aligned with DoD 8510.01 RMF requirements, CNSSI 1253 categorization, and eMASS workflow.
Is this eMASS compatible?
It complements eMASS — use it to track your progress and prep your entries. It doesn’t replace eMASS.
Can I use this for multiple systems?
Yes — duplicate the file for each system you support.
Your next ATO doesn’t have to be a scramble.