Which SP 800-65 step focuses on prioritization requirements?

• A. Identify prioritization requirements
• B. Run a quarterly vulnerability scan
• C. Adopt a standard encryption algorithm
• D. Establish continuous monitoring

Answer: (A)

Prioritization of requirements is about deciding which security needs and actions must be addressed first based on risk, mission impact, and available resources. In SP 800-65, this step establishes the order and importance of requirements so that effort and investments go toward the most critical safeguards first, guiding how controls are selected, implemented, and validated within the certification and accreditation process.

The other items describe concrete security activities that aren’t about setting priority. Running a quarterly vulnerability scan is an assessment activity to identify weaknesses. Adopting a standard encryption algorithm is about choosing a specific cryptographic control. Establishing continuous monitoring is about ongoing assurance after implementation.