In what phases of the Risk Management Framework (RMF) and system development life cycle (SDLC), respectively, does documentation of control implementation start? Response:

RMF Categorization and SDLC initiation occur at earlier stages, focusing on system classification and initial planning before controls are implemented or their documentation begins.

In the RMF, documentation of control implementation formally begins during the 'Implement Security Controls' step (Step 3), as controls are being configured and put into operational use, and their details must be recorded. Concurrently, within the SDLC, the 'Development/Acquisition' phase is when systems are built or procured, and security controls are integrated into the system, requiring immediate documentation of their implementation details.

RMF Authorization and SDLC operations/maintenance phases occur after control implementation, focusing on system approval and ongoing support, respectively.

RMF Monitor and SDLC sunset phases address continuous oversight and system decommissioning, which are much later stages than the start of control implementation documentation.