Information System and Environment Changes, determine the security impact of proposed or actual changes to the information system and its environment of operation; is Task _____ in RMF Step 6…

NIST SP 800-37 Rev. 2 outlines the RMF steps, and within Step 6 (Monitor), Task M-1 is titled "Information System and Environment Changes" which focuses on assessing the security impact of modifications to the system or its operational environment. This task ensures continuous awareness of the security posture as changes occur.

Task M-2 in RMF Step 6 focuses on assessing the security controls, not specifically on system and environment changes.

Task M-3 in RMF Step 6 deals with ongoing security authorization, which is a broader activity than just assessing system changes.

Task M-4 in RMF Step 6 involves reporting security posture, which is a downstream activity from assessing changes.