The RMF Step and task where the security controls are selected and documented in the Security Plan. Response:

RMF Step 2, Task 3 (2-3) is 'Apply Control Enhancements,' which occurs after the initial control selection and documentation.

According to the NIST Special Publication 800-37 Rev. 2, the Risk Management Framework (RMF) Step 2 is 'Select Controls.' Within this step, Task 2-2 is specifically designated for 'Document Controls,' where the organization documents the selected, tailored, and supplemented security and privacy controls in the security plan. This task ensures that the chosen controls, including common controls and system-specific controls, are formally recorded as part of the system's security documentation.

RMF Step 2, Task 4 (2-4) is 'Develop Monitoring Strategy,' which is focused on continuous monitoring, not the initial control selection and documentation.

RMF Step 2, Task 1 (2-1) is 'Select Baseline Controls,' which is the initial selection of a control baseline, but Task 2-2 is where those selected controls are formally 'documented in the Security Plan.'