What is RMF Step 3? Response:

The correct answer is A. Implement Controls. In the original NIST Risk Management Framework (RMF) as defined in NIST SP 800-37 Rev 1, there are six sequential steps: (1) Categorize, (2) Select Controls, (3) Implement Controls, (4) Assess Controls, (5) Authorize, and (6) Monitor. Step 3 is 'Implement Controls,' where…

Implementation of Security and Privacy Controls

Question

Options

AImplement Controls
BSelect Controls
CAssess Controls
DMonitor

How the community answered

(18 responses)

A
89% (16)
C
6% (1)
D
6% (1)

Explanation

In the original NIST Risk Management Framework (RMF) as defined in NIST SP 800-37 Rev 1, there are six sequential steps: (1) Categorize, (2) Select Controls, (3) Implement Controls, (4) Assess Controls, (5) Authorize, and (6) Monitor. Step 3 is 'Implement Controls,' where security and privacy controls identified in the Select phase are actually put into place within the information system and its environment. This is why answer A is correct. Note: NIST SP 800-37 Rev 2 added a 'Prepare' step, shifting the numbering - but exam questions referencing the classic 6-step RMF use the Rev 1 ordering, where Implement is Step 3. The distractors (Select = Step 2, Assess = Step 4, Monitor = Step 6) are all valid RMF steps, just at different positions in the lifecycle.

Topics

#RMF Steps#NIST RMF#Control Implementation#SP 800-37

Community Discussion

No community discussion yet for this question.

Full CGRC Practice