This is the wrong question to ask because the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the NIST Risk Management Framework (RMF) are widely different from each other. They are complements to each other, rather than opposing frameworks. Choosing one doesn't exclude you from using the other. A better question to ask is: Should your organization incorporate the CSF and/or the RMF? As with everything related to business, it depends on the organization's goals, stakeholders, and industry, among other things.
Differences between CSF and RMF
The RMF is mandated for any Federal Government organization and is hardly used in the private sector. In contrast, the CSF is voluntary and is aimed towards private sector use, especially in critical infrastructure industries. The RMF has more documentation and is far more complicated than the CSF. Because of this, the CSF is much more approachable and easier to implement. Furthermore, implementing the RMF requires formal Authorization to Operate (ATO), while the CSF does not require such government involvement to implement. RMF security controls are usable with the CSF; however, the CSF does not have its own set of controls. Each function of the CSF can be satisfied by implementing other frameworks such as COBIT and the ISO 27000 series. The CSF is not intended to replace the RMF; in fact, the RMF is intended to be used with CSF according to NIST's recommendations. Lastly, when incorporating the CSF or another similar framework, organizations still need some sort of framework that deals with risk management, such as the RMF or ISO 31000 (Tracy, 2017; Webb, 2017).
Conclusion
Since the RMF is mandatory for Federal agencies, it may be best (perhaps even required in the future) to implement the RMF if your organization is a partner of the Federal Government. On the other hand, if your organization is not a partner or foreseeable partner of the Federal Government, it may be best to pass on the RMF due to its complexity. If the RMF is adopted, it is also best to incorporate the CSF due to NIST's recommendations. If RMF is not adopted, your organization can still adopt the CSF or a different framework to meet cybersecurity goals. If your organization is in one of the critical infrastructure industries, it is recommended to go with the CSF over other security frameworks. Remember that some sort of framework for risk management is still needed regardless of what security framework you choose. An alternative to the RMF is the International Organization for Standardization (ISO) 31000, which is helpful to any organization no matter the shape and size (Peterson, 2019). Not just Federal Government agencies.
Summary
The CSF and RMF are incredibly different. They are designed to work with each other, not against each other. As a result, the CSF is better compared to other security frameworks such as COBIT or the ISO 27000 series. At the same time, the RMF is better compared to other risk management frameworks such as ISO 3100. The key takeaway is that there are multiple security frameworks and multiple risk management frameworks. At least one security framework and one risk management framework should be adopted to work together. The choice of framework in both categories depends on many factors, such as industry, goals, and stakeholder needs.
References
Peterson, O. (2019, July 24). What is ISO 31000? Getting started with risk management. Process Street. https://www.process.st/iso-31000/
Tracy, R. (2017, May 18). A tale of two frameworks: The nist csf and nist rmf are not the same. Telos Corporation. https://www.telos.com/2017/05/tale-of-two-frameworks-nist-csf-and-nist-rmf-confusion/
Webb, N. (2017, October 17). Top ten—Differences between RMF and CSF. IT Dojo. https://www.itdojo.com/top-ten-differences-between-rmf-and-csf/
Image Source: Perforce