Change management is initiated under which phase? Response:

“Select security controls” is an early RMF step where controls are chosen based on system categorization, not where ongoing change management is initiated.

“Categorize information system” is the initial RMF step where the system's impact level is determined, long before changes requiring formal management occur during operations.

“Authorize information system” is the step where a senior official grants approval to operate the system, which happens before the continuous monitoring and change management cycle.

During the "Monitor security controls" phase, ongoing assessments and continuous monitoring activities identify changes to the information system, its operating environment, or the threat landscape. Change management processes are crucial here to assess the security impact of these changes and ensure appropriate security controls are updated, implemented, or adjusted to maintain the system's authorization boundary and risk posture.