The registration of the system directly follows which Risk Management Framework (RMF) task? Response:

Categorizing the system (Step 1, Prepare) involves assigning impact levels, which generally occurs before or in conjunction with describing the system, but registration isn't directly *after* categorization.

In the NIST Risk Management Framework (RMF), the 'Describe System' task involves documenting the system's characteristics, including its boundaries, architecture, and data flows, which is a prerequisite for formal registration within the organization's inventory. Registration is an administrative step that formalizes the system's existence within the RMF process after its basic description is complete, both occurring within the 'Prepare' step.

Review and approval of the system security plan (Step 4, part of Authorize) happens much later in the RMF process, after controls have been implemented and assessed.

Selecting security controls (Step 2) happens after the system is categorized and described, preceding implementation and assessment.