In the RMF, which step directly follows 'Assess'?

• A. Categorize
• B. Select
• C. Authorize
• D. Monitor

Answer: (C)

After Assess, the next step is Authorization. During the Assess phase, the effectiveness of the implemented security controls is evaluated and the results feed into a formal risk-based decision. The Authorizing Official reviews those results, determines the level of residual risk, and decides whether the system is allowed to operate. If the risk is deemed acceptable, an Authorization to Operate is granted. If not, remediation or modification is required before authorization can be given. Once authorized, continuous monitoring begins to ensure controls remain effective as the system evolves.