Overlays can be implemented as part of control tailoring. In which step of the assessment and authorization process is control tailoring done? Response:

A Privacy Impact Assessment (PIA) focuses on privacy risks and is typically conducted as part of the overall system development lifecycle, but it is not the specific step where security control tailoring occurs.

Security Categorization is the process of assigning impact levels (low, moderate, high) to information systems based on the potential impact of a loss of confidentiality, integrity, or availability, preceding control selection and tailoring.

Risk Assessment is an ongoing process of identifying, analyzing, and evaluating risks, which informs control selection but is not the step where controls are formally tailored and documented.

The "Select" step in the NIST RMF is where an organization selects, tailors, and supplements the baseline security controls based on the system's security categorization, common controls, and applicable overlays, as described in NIST SP 800-37. This ensures the controls are appropriate for the system's specific environment and risk posture.