Della works as a security engineer for BlueWell Inc. She wants to establish configuration management and control procedures that will document proposed or actual changes to the information system…

The Initiation phase involves defining and categorizing the information system and selecting applicable security controls, not establishing ongoing change management procedures.

Security Certification involves assessing and evaluating the security controls of an information system to determine if they are implemented correctly and effectively.

Continuous Monitoring is the NIST SP 800-37 RMF phase where organizations maintain an ongoing awareness of their security and privacy posture by continuously assessing security controls, documenting changes, and responding to incidents. Configuration management and control procedures are essential elements of this phase, ensuring that all proposed or actual changes to the system are tracked and assessed for security impact to maintain the system's authorization status.

Security Accreditation is the formal declaration by a designated approving authority that an information system is authorized to operate, based on the security assessment and risk determination, rather than defining ongoing change control processes.