Which outcome best describes Task P-1 Risk Management Roles?

• A. A formal authorization package is prepared.
• B. Individuals are identified and assigned key roles for executing the Risk Management Framework.
• C. System assets are identified and inventoried.
• D. Continuous monitoring activities are planned.

Answer: (B)

The main concept is establishing who will be responsible for carrying out the Risk Management Framework by identifying individuals and assigning key roles. In RMF, having clear, assigned roles from the start sets up the governance and accountability structure needed to execute every step—from categorizing the system to selecting, implementing, assessing controls, granting authorization, and continuously monitoring.

This is the best fit because Task P-1 centers on organizing who does what. If you don’t identify the people and assign the roles, there’s no clear owner for essential activities, and risk management can stall or lack authority. The other descriptions reference outputs from later stages—preparing an authorization package is tied to the authorization step, identifying system assets is part of asset management, and planning continuous monitoring belongs to the monitoring phase. None of those capture the initial setup of responsibilities that Task P-1 is about.