-: In step four, 2 2
you'll implement the controls 3 3
that you selected in RMF step three. 4 4
Now, there are only two tasks in step number four. 5 5
Task I-1 will end with all your controls implemented 6 6
in your system. 7 7
While you implement your controls, 8 8
make sure that they're consistent 9 9
with the intent of your organization's policies. 10 10
And if you're implementing a control 11 11
that is an off-the-shelf product, 12 12
I want you to favor those 13 13
that have been evaluated as safe 14 14
by a trustworthy, independent, third party organization. 15 15
Finally, take a look at your assurance requirements 16 16
and make sure that the people developing 17 17
and implementing the controls are doing so correctly 18 18
and in compliance with your security requirements. 19 19
The second and last task in step four is I-2. 20 20
And during this task, you'll update your security 21 21
and privacy plans with all the details 22 22
of your implementation activities. 23 23
After all, not everything you plan will be possible 24 24
to complete as you intend it. 25 25
So update your security and privacy plans 26 26
with details describing how you actually implemented 27 27
the controls that you selected in step three. 28 28
I want you to include details about changes 29 29
to planned inputs, the expected behavior, 30 30
and the expected outputs. 31 31
All right, that brings us to the end of step four of RMF, 32 32
which is called implement controls.