Enhancing RMF with AI: Threat-centric control selection based on MITRE techniques

Organizations are strongly encouraged to comply with frameworks such as NIST SP 800-53, and selecting appropriate security controls is a critical responsibility. Traditional risk assessment methods evaluate asset risk levels based on confidentiality, integrity, and availability, but this qualitative approach lacks clarity on specific threat protection, varies by expert judgment, and fails to reflect attacker intent. This paper presents a methodology that recommends controls to protect assets based on MITRE techniques. The method is quantitative, automatable, less prone to expert-driven variability, and capable of incorporating attacker intent. Our experiment predicted attacker next actions and showed improved mitigation over traditional methods.