Oooh, great digging! I am a federal contractor and had to research the Risk Management Framework which is getting inserted Into a lot of contracts. Like all things government, it is horrendously complicated by the documentation. But basically it is a process where the contractor shows the government it has the controls in place to mitigate adverse risk with their created product(s), especially by intrusion or having the software do unexpected things - like send data to China. The government then agrees with “Yea, verily” and the contractor is given the go ahead - the “Authority to Operate”. Cybersecurity risk is a big deal in DoD currently. But if you oversee voting machines... “meh”!