In RMF, security control baselines serve as starting points for selecting controls by impact level. In which step are these baselines used?

• A. Step 1 Categorize
• B. Step 5 Authorization
• C. Step 2 Select
• D. Step 6 Monitor

Answer: (C)

Baselines are the predefined sets of controls matched to impact levels that guide the initial control choice. After determining the system’s impact level in Categorize, you use the corresponding baseline in the Select step as the starting point for choosing controls. You tailor and supplement that baseline to fit the system’s specific needs, then proceed to implement, assess, authorize, and monitor.