Which RMF step involves implementing security controls?

• A. Categorize
• B. Select
• C. Implement
• D. Monitor

Answer: (C)

Implementing security controls is the phase where the chosen protections are actually put into place and made to work within the system. It involves configuring devices and software, applying the selected controls, integrating them into the environment, and ensuring they are operational. This is the step that turns planning into an active defense—without deployment, controls exist only as ideas. After implementation, you assess how well they’re working and then continuously monitor them to maintain effectiveness. Categorizing sets the impact level, and selecting determines which controls to use based on that baseline, while monitoring is the ongoing verification that they stay effective.