Which sequence accurately orders the RMF steps from start to finish?

• A. Categorize; Implement; Select; Assess; Authorize; Monitor
• B. Categorize; Implement; Select; Assess; Authorize; Monitor
• C. Categorize the information system; Select security controls; Implement and/or ensure/ apply controls; Assess controls; Authorize system operation; Monitor security state
• D. Categorize; Select; Assess; Implement; Authorize; Monitor

Answer: (C)

Understanding the order of the RMF steps is essential. You begin by categorizing the information system to determine the potential impact on operations, assets, and individuals. Once you know the required protection level, you select the security controls that meet those requirements. After choosing controls, you implement or apply them within the system. With the controls in place, you assess their effectiveness to verify proper implementation and adequacy. Based on the assessment, you obtain authorization to operate the system. Finally, you engage in continuous monitoring to track the security state and detect changes, feeding updates back into the process as needed.

This sequence reflects why the other arrangements don’t fit: control selection depends on the system’s impact categorization; controls must be in place before you can assess them; authorization relies on a validated assessment; and monitoring is ongoing, not a one-time final step.