Which task concerns Information Types?

• A. Information Life Cycle
• B. System Registration
• C. Risk Assessment - System
• D. Information Types

Answer: (D)

The main idea here is that this task focuses on the kinds of information the system handles and how their presence and sensitivity drive security decisions. In RMF, when you categorize a system, you identify the Information Types—the specific data categories the system processes (such as personal data, confidential business information, or public data). Recognizing these types helps determine the potential impact on confidentiality, integrity, and availability if those data were compromised, which then guides the security controls you select and apply.

This is distinct from other tasks like Information Life Cycle (which traces how information moves and transforms), System Registration (inventorying and describing the system), or Risk Assessment for the system (evaluating overall risk). Because Information Types directly address what data the system handles and how sensitive each type is, it is the task that concerns Information Types.