Page 326 - Cyber Defense eMagazine September 2025

The Dilemma

The RMF exists to manage risk and not generate more of it. In its current form, the process is often seen
as an impediment rather than a mission enabler. Teams across the federal IT landscape have called for
simplification, suggesting self-attestation or replacing controls with risk scoring. Others are ready to
dismantle the framework altogether.

There is no need to choose between speed and security. Instead, the RMF must evolve to match the
pace of mission by embedding automation, infrastructure-as-code, and real-time visibility into every stage
of the compliance lifecycle.

Challenges Facing Federal Risk Management

Agencies face growing pressure to deliver secure services with fewer resources. The result? Long-
standing compliance challenges become even more difficult to address. The four biggest pain points
include:

• Compliance and audit complexity: Documentation-heavy, checklist oriented, manual, and often
redundant, the current RMF requires ongoing coordination and exhaustive validation, further
burdened by time-consuming audits.
• Limited risk visibility: Disparate systems, inconsistent documentation and the infrequency of
assessing controls obscure the true risk picture, leading to decision-makers lacking timely insights
into security control effectiveness.
• Velocity: Modern systems evolve continuously driven by DevOps, agile development, and
infrastructure-as-code. But compliance often lags, measured in months when systems are
changing by the hour. Supporting RMF in this era requires compliance postures to evolve with
the systems themselves, including always-on monitoring of key controls in real-time.
• Budget pressures: With agencies under mandates to redirect spending toward mission enabling
services, internal support functions like security and compliance often take the hit, threatening
long-term resilience and security readiness.

A Smarter Approach to RMF

Agencies don’t need to abandon the RMF. Overhauling the RMF approach starts with automation.

Using secure DevOps automation, built with policy and infrastructure as code, government agencies can
quickly deploy pre-configured, compliant environments on all major cloud platforms. These environments
include embedded security services such as vulnerability management, access controls, and log
monitoring mapped directly to NIST SP 800-53 controls.

An approach that leverages a component definition registry further supports this model, offering reusable
security components that are validated automatically and ready to plug into multiple systems. When these

Cyber Defense eMagazine – September 2025 Edition 326
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.