Outline RMF steps.

• A. Plan, Identify, Implement, Authorize, Monitor.
• B. Categorize, Select controls, Implement/Assess, Authorize, Monitor.
• C. Categorize, Select controls, Implement/Assess, Authorize, Monitor; continuous monitoring.
• D. Identify, Select controls, Implement/Assess, Authorize, Monitor; continuous monitoring.

Answer: (C)

The main idea is the structured lifecycle used to manage risk for information systems: you categorize the system by impact, choose appropriate security controls, implement those controls and verify them, obtain authorization to operate, and then continuously monitor the security posture. This sequence is best shown by listing Categorize, Select controls, Implement/Assess, Authorize, Monitor, with the important note that monitoring is an ongoing, continuous activity.

Why this is the best fit: it matches the standard RMF flow and explicitly includes continuous monitoring, which is essential because risk and threats evolve over time. Implementing and assessing controls are tied together in practice—once you put controls in place, you assess their effectiveness, and the results feed into authorization and ongoing monitoring.

The other options miss key RMF elements or use terminology that isn’t part of the RMF sequence. For example, using identifiers like Identify instead of Categorize doesn’t align with RMF terminology, and omitting the emphasis on continuous monitoring leaves out the ongoing nature of risk management.