Directive controls are a form of change management policy and procedures. Which of the following subsections are recommended as part of the change management process?

Build and test is a recognized subsection of the change management process, where proposed changes are constructed in a controlled environment and validated before production deployment. This phase ensures that changes do not introduce unintended vulnerabilities or failures, aligning with standard change management frameworks such as ITIL and NIST guidelines. It is a core step in directive controls that govern how changes are safely introduced into an environment.

Implementing security controls is part of the Risk Management Framework (RMF) or a security control implementation process, not a subsection of the change management process itself.

Categorizing the Information System is the first step of the NIST Risk Management Framework (RMF), specifically under FIPS 199 and NIST SP 800-60, and is not a subsection of change management.

Selecting security controls is Step 2 of the NIST RMF process (NIST SP 800-53), which is part of the security authorization framework, not a component of change management procedures.