Which option correctly identifies the formal process for categorizing and authorizing security controls for AFCOMAC systems?

• A. OPORD
• B. RMF is a structured process for categorizing, selecting, implementing, assessing, authorizing, and monitoring security controls for systems.
• C. Battle rhythm
• D. Incident response

Answer: (B)

Risk Management Framework provides a formal lifecycle for securing information systems. It guides you through categorizing the system’s impact, selecting and implementing appropriate security controls, assessing their effectiveness, obtaining authorization to operate, and then continuously monitoring the controls. This structured process directly addresses both how to categorize security controls and how to authorize them before the system operates, ensuring a formal, risk-based approach.

The other terms aren’t about this lifecycle: an operation order is about mission planning and execution, battle rhythm is the cadence of military activities, and incident response focuses on reacting to security events rather than the formal, ongoing process of categorizing and authorizing controls.