Which are the main RMF steps used for securing information systems?

• A. Categorize, Select, Implement, Assess, Authorize, and Monitor
• B. Design, Develop, Test, Deploy, Monitor
• C. Identify, Evaluate, Remediate, Approve
• D. Plan, Build, Operate, Decommission

Answer: (A)

The six-step Risk Management Framework used to secure information systems is being tested. In this framework, you go through a cycle: categorize the system to determine the impact levels for confidentiality, integrity, and availability; select the appropriate security controls (and tailor them to the system); implement those controls; assess their effectiveness and identify weaknesses; authorize operation through a formal authorization decision; and continuously monitor the security state to detect changes and maintain risk posture. This sequence provides a structured, risk-based approach to protecting information systems.

The other option resembles a software development lifecycle (design, develop, test, deploy, monitor) rather than the governance-focused RMF process. Another option outlines general risk remediation steps (identify, evaluate, remediate, approve) that don’t capture the formal RMF stages or the ongoing authorization and monitoring components. The last option mirrors a generic project or system lifecycle (plan, build, operate, decommission) but lacks the specific RMF steps and the continuous monitoring and authorization aspects.