RMF Step 3 - Implement Controls includes which of the following activities?

• A. Security Control Implementation
• B. Common Control Identification
• C. Security Control Selection
• D. Monitoring Strategy

Answer: (A)

RMF Step 3 focuses on putting the chosen controls into place. Implementing them means deploying the controls in the system, configuring them correctly, and integrating them with the environment and processes so they are actually operating as intended. This also includes updating documentation such as the System Security Plan and providing evidence that the controls are in place for the upcoming assessment. The other activities listed belong to different RMF steps: identifying common controls and selecting controls are part of the Step 2 Select phase, and establishing a monitoring strategy is tied to the ongoing continuous monitoring (Step 6).