The software security and reliability consulting firm Cigital has used its
proprietary Cigital RMF for more than a decade. Under contract to DHS, Cigital
developed the BuildSecurityIn (BSI) RMF, a condensed version of the Cigital
RMF. The BSI RMF consists of five-phases of risk management activities: