Which sequence correctly represents the RMF steps used to authorize DoD information systems?

Which sequence correctly represents the RMF steps used to authorize DoD information systems?

• A. Identify, Categorize, Select, Implement, Assess, Authorize
• B. Categorize, Select, Implement, Assess, Authorize, Monitor
• C. Define, Select, Implement, Assess, Authorize, Monitor
• D. Categorize, Plan, Implement, Assess, Authorize, Monitor

Answer: (B)

The main idea tested is the six-step RMF lifecycle used to authorize DoD information systems. In RMF, you start by categorizing the system to determine the level of impact and the corresponding protection needs. Next, you select the appropriate security controls based on that categorization. After selecting, you implement those controls in the system. Once implemented, you assess them to verify they’re applied correctly and functioning as intended. With a positive assessment, you obtain authorization to operate. Finally, you continuously monitor the controls and the system to detect changes and maintain ongoing assurance. That exact order—Categorize, Select, Implement, Assess, Authorize, Monitor—fits the RMF framework precisely, ensuring controls are chosen and tested before a formal authorization, with ongoing monitoring to manage risk over time. Other sequences stray from the standard terms or misplace steps (for example, using terms not part of RMF or inserting planning/defining in place of categorization, or moving monitoring ahead of authorization), which is why they aren’t correct.

The main idea tested is the six-step RMF lifecycle used to authorize DoD information systems. In RMF, you start by categorizing the system to determine the level of impact and the corresponding protection needs. Next, you select the appropriate security controls based on that categorization. After selecting, you implement those controls in the system. Once implemented, you assess them to verify they’re applied correctly and functioning as intended. With a positive assessment, you obtain authorization to operate. Finally, you continuously monitor the controls and the system to detect changes and maintain ongoing assurance.

That exact order—Categorize, Select, Implement, Assess, Authorize, Monitor—fits the RMF framework precisely, ensuring controls are chosen and tested before a formal authorization, with ongoing monitoring to manage risk over time. Other sequences stray from the standard terms or misplace steps (for example, using terms not part of RMF or inserting planning/defining in place of categorization, or moving monitoring ahead of authorization), which is why they aren’t correct.