feat: add NIST SP 800-37 Rev 2 Risk Management Framework (RMF) skill

[sjackson0109]

NIST SP 800-37 Rev 2 -- Risk Management Framework (RMF)

Source: NIST Special Publication 800-37 Revision 2, December 2018
https://doi.org/10.6028/NIST.SP.800-37r2

---

Summary

This PR adds a complete Claude skill for NIST SP 800-37 Rev 2, the authoritative NIST guide defining the Risk Management Framework (RMF) for federal information systems. The RMF is the standard process used across the US federal government for Authorisation to Operate (ATO) under FISMA. The skill covers all seven RMF steps, all defined roles, the full authorization package, SSP, SAR, and POA&M guidance.

---

Files Added

plugins/nist-sp-800-37/
  .claude-plugin/plugin.json
  skills/nist-sp-800-37/
    SKILL.md
    references/
      rmf-steps-tasks.md
      authorization-package.md
      roles-and-responsibilities.md

---

Framework Coverage

Seven RMF Steps (Rev 2 adds Prepare):

Step 0 -- Prepare: 10 organisation-level tasks (P-1 to P-10) covering risk management roles, strategy, org-level risk assessment, control assignments, mission/business analysis, information type taxonomy, common control identification, tailoring guidance, enterprise architecture, and requirements; 8 system-level tasks (P-11 to P-18) covering stakeholders, system roles, assets, system risk assessment, authorisation boundary, registration, legal requirements, and common control inheritance.

Step 1 -- Categorise: FIPS 199 high-water mark methodology; SP 800-60 information type taxonomy; provisional value adjustment; system impact level determination; mapping to SP 800-53 Rev 5 baselines.

Step 2 -- Select: Baseline selection; tailoring actions (scoping, parameterisation, compensating controls, additions, overlays); control assignment (system-specific, common/inherited, hybrid); monitoring strategy integration; SSP approval cycle. Complete SP 800-53 Rev 5 control family index (20 families, AC through SR).

Step 3 -- Implement: Control implementation; SSP implementation narrative with full field-by-field template for each control entry.

Step 4 -- Assess: SAP preparation; control assessment using examine/interview/test methods; SP 800-53A depth and coverage parameters; remediation before finalising SAR; POA&M creation. Assessor independence requirements by impact level.

Step 5 -- Authorise: Authorization package assembly; risk determination; risk response (accept/mitigate/transfer/avoid); ATO, ATU, Ongoing Authorization, and DATO types; ATO decision factors; risk acceptance statement format; FISMA reporting.

Step 6 -- Monitor: Continuous monitoring strategy; configuration management; ongoing assessments; ongoing risk response; authorization updates for significant changes; security posture reporting; system disposal.

Roles and Responsibilities: All 12 SP 800-37 Rev 2 roles with appointment requirements, responsibilities, role combination rules, and conflict-of-interest prohibitions (AO, AODR, SAOP, CISO, Risk Executive, System Owner, ISSO, ISSM, SCA, CCP, Mission Owner, System Administrator).

Reference Files

rmf-steps-tasks.md: Complete task tables for all seven RMF steps with task numbers, names, primary inputs, key outputs, and role assignments; FIPS 199 step-by-step categorisation process; SP 800-53 Rev 5 control family index; SDLC phase to RMF task integration mapping.

authorization-package.md: Full authorization package checklist (required and conditional documents); SSP template with all required sections and fields; SAR structure per SP 800-53A with per-control finding format; POA&M format with all required fields per OMB M-02-01; ATO memo contents; authorization conditions; risk acceptance statement guidance.

roles-and-responsibilities.md: Detailed responsibilities for all defined RMF roles; appointment authority; role combination permissions; critical conflict-of-interest prohibitions; common control provider examples.

Integration Points

• NIST SP 800-30 Rev 1: Risk assessments inform categorisation and feed the ATO package
• NIST SP 800-39: RMF operates within the three-tier enterprise risk management structure
• NIST SP 800-53 Rev 5: The 20 control families selected and tailored in Step 2
• NIST SP 800-53A: Assessment procedures referenced for Step 4
• NIST SP 800-137: Continuous monitoring strategy feeds Step 6
• NIST CSF 2.0: Explicit alignment referenced in Prepare step per Rev 2

Tests

All 10 plugin structure tests pass:

tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_exists[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_is_valid[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_required_fields[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_version_semver[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_exists[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_has_one_skill_folder[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_exists[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_not_empty[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_no_files_outside_skill_folder[nist-sp-800-37] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_references_are_markdown[nist-sp-800-37] PASSED