Which task covers Control Implementation?

• A. Update Control Implementation Information
• B. Plan Review and Approval
• C. System Disposal
• D. Control Implementation

Answer: (D)

In RMF, putting security controls into operation is the action that directly realizes the chosen safeguards. The task that covers Control Implementation focuses on applying and configuring the selected controls across the system, documenting how each control is realized, and ensuring it’s integrated with day-to-day operations. This is the phase where you actually enable protections—setting up access controls, encryption, monitoring, and system hardening so the controls function within the environment. The other options describe supporting or later activities: updating control implementation information is about maintaining documentation after deployment; plan review and approval is a governance step before deployment; and system disposal concerns decommissioning a system. So the task that best covers Control Implementation is the one that directly implements the controls.