How does RMF treat cloud computing within the authorization framework?

• A. RMF ignores cloud.
• B. RMF uses only provider's controls.
• C. RMF accommodates cloud through shared or system-specific controls; boundary and monitoring considerations differ; rely on provider's authorization where applicable.
• D. RMF prohibits cloud.

Answer: (C)

RMF treats cloud as a shared-responsibility environment where control tasks are split between the cloud provider and the customer. Because the infrastructure may be managed off-site and often by a third party, the authorization boundary isn’t the same as for an on‑premises system. You map which controls the provider handles and which remain under your control, and you tailor the control baseline accordingly. Monitoring and assessment flows are different too, since some monitoring is provided by the cloud service, while your organization still retains responsibility for the controls that are yours. When appropriate, you rely on the provider’s authorization for the controls they own, but you maintain your own authorization for the parts you control. This approach lets you use cloud services without abandoning RMF rigor. Cloud isn’t ignored, it isn’t fully provider-only, and it isn’t prohibited.