Which of the following is NOT one of the six steps in the Risk Management Framework (RMF) used to manage cyber risk for information systems?

• A. Categorize
• B. Select
• C. Encrypt
• D. Monitor

Answer: (C)

The process being tested is the Risk Management Framework (RMF), a lifecycle used to manage cyber risk for information systems. It consists of six distinct steps: categorize the system and the data to determine impact levels, select the appropriate security controls, implement those controls, assess their effectiveness, authorize the system to operate, and continuously monitor the security state. Encryption is a security control technique that can be used within the implementation of controls or during assessment, but it is not itself a separate RMF step. Knowing the six-step flow helps you see that categorizing, selecting, and monitoring fit as steps, while encryption is a tool used within the framework rather than a standalone step.