In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed?

RMF Phase 0 (Prepare) involves establishing the context, priorities, and risk management strategy at both the organizational and system levels before system-specific steps begin. Strategic risk assessment planning - including defining risk tolerance, identifying key stakeholders, and establishing a risk management strategy - is performed during this phase as a foundational activity per NIST SP 800-37 Rev 2.

Phase 1 is the Categorize phase, where information systems are categorized based on impact levels using FIPS 199 and NIST SP 800-60.

Phase 2 is the Select phase, where security and privacy controls are selected based on the system's impact categorization using NIST SP 800-53.

Phase 3 is the Implement phase, where the selected security controls are actually deployed and documented within the information system.