What is the system development life cycle phase for step six of the RMF for an existing system? Response:

Development and Acquisition is an earlier phase of the SDLC where the system is being built or procured, not where continuous monitoring occurs.

Implementation/Assessment are distinct RMF steps (Step 3: Implement, Step 4: Assess) and phases within the SDLC, but neither fully encompasses the ongoing nature of RMF Step 6 for an existing system.

While 'Maintenance' is part of D, 'Operations/Maintenance' is a more comprehensive phase that includes ongoing monitoring and security management for an operational system.

Step six of the NIST RMF is 'Monitor,' which involves continuously monitoring the security controls, assessing changes to the system and its environment, and conducting ongoing risk assessments. For an existing system, this continuous monitoring and management activity perfectly aligns with the Operations/Maintenance phase of the System Development Life Cycle (SDLC), where the system is operational and actively managed.