What action is described by Update Control Implementation Information?

• A. Documentation of planned control changes is optional.
• B. Changes to the planned implementation of controls are documented.
• C. The security and privacy plans are discarded after implementation.
• D. No changes are tracked.

Answer: (B)

Documenting changes to how controls will be implemented is about keeping an accurate, up-to-date record of how planned controls are actually deployed. In the RMF process, the plan for implementing security controls isn’t fixed—deployment can lead to adjustments in baselines, control parameters, or the introduction of compensating measures. Recording these changes creates an auditable trail and ensures the security plan and assessment documentation reflect the current state, which in turn supports ongoing authorization and monitoring.

If changes aren’t documented, or if plans are discarded after implementation, or if no changes are tracked, the record would not reliably reflect reality or support subsequent evaluations.