In the RMF, which step involves categorizing the information system?

• A. Categorize
• B. Select
• C. Implement
• D. Assess

Answer: (A)

Categorizing the information system is the step that determines how much protection the system needs by evaluating the potential impact to confidentiality, integrity, and availability if there were a breach or failure. Guided by standards like FIPS 199 and NIST SP 800-60, you assign a security category (low, moderate, or high) to the system and its data. That categorization sets the baseline controls you will select and informs the entire risk management process, because the level of controls chosen later depends on how the system is categorized. Once the system is categorized, you move on to selecting the appropriate controls, implementing them, and then assessing their effectiveness. Mis-categorizing can lead to under- or over-protection, causing gaps or wasted resources.