In what phases of the RMF and SDLC, respectively, does documentation of control implementation start? Response:

In the RMF, control implementation and its documentation occur during the "Implement Controls" phase, where controls are applied and described. Similarly, within the SDLC, the "Development/Acquisition" phase is when security controls are built into the system and their implementation details are first recorded.

Categorization and Initiation are earlier phases in RMF/SDLC where system boundaries and impact are determined, not where control implementation documentation starts.

Authorization and operations/Maintenance are later phases; authorization follows implementation and assessment, and maintenance is an ongoing activity after initial implementation.

Monitor and Sunset are post-implementation phases, with monitoring being continuous and sunset being system decommissioning.