During which RMF step is the system security plan initially approved? Response:

RMF Step 1 is "Prepare," where foundational activities like defining the risk management strategy and roles occur, but the SSP isn't approved for implementation yet.

RMF only has six or seven steps depending on the version (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor). There is no "RMF STEP 12."

In the NIST Risk Management Framework (RMF), the System Security Plan (SSP) is initially approved during Step 3, "Implement." While the SSP is developed and refined in earlier steps (Categorize and Select), the approval to proceed with implementation based on the documented plan occurs in Step 3, signifying a formal commitment to the chosen security controls.

RMF Step 5 is "Authorize," which is where the authorizing official makes the final risk acceptance decision and grants the authorization to operate, not the initial approval of the SSP for implementation.