Which task is responsible for Common Control Identification?

• A. Common Control Identification
• B. Security Categorization
• C. System Stakeholders
• D. Information Lifecycle

Answer: (A)

The task being tested is recognizing the action of identifying which security controls can be shared across multiple information systems. In RMF, common controls are those security controls that can be implemented at an enterprise or environment level and inherited by several systems, rather than being tailored for a single system. Identifying these common controls is the specific activity that determines which controls are considered common and how they fit into the overall security baseline. This identification is essential because it streamlines risk management: you can rely on a set of shared controls across systems and focus your effort on system-specific controls for any unique risks.

The other options relate to different RMF activities and concepts but do not address identifying shared controls. Security categorization is about determining the impact level of a system; system stakeholders are those with vested interests or authority; information lifecycle covers the stages data goes through from creation to disposal. While these areas influence how controls are selected and applied, they do not perform the identification of common controls itself.

So, the best answer is the task whose name directly describes the action of identifying common controls.