Which task handles Security Categorization?

• A. Security Categorization Review and Approval
• B. Security Categorization
• C. System Description
• D. Control Allocation

Answer: (B)

In RMF practice, the action of determining how sensitive the system and its information are starts with assigning impact levels for confidentiality, integrity, and availability. This labeling is exactly what Security Categorization does. It’s the task that handles the categorization because its purpose is to perform the categorization itself—establishing the security category that will drive which controls are needed.

This step usually occurs at the beginning of the RMF process in the categorization phase, drawing on criteria like FIPS 199 to set whether each impact level is low, moderate, or high. The result then guides which controls to select and implement.

Other tasks serve different roles: describing the system’s characteristics and boundaries, determining where and how controls are applied (control allocation), or reviewing and approving the categorization after it’s done.