Arturo is leading a project to commission a new information system that will be used by a U.S. federal government agency. The agency uses the risk management framework (RMF) approach for Federal Information Security Management Act (FISMA) compliance. He is working with his team to assess and document agency IT systems based on risk. What step of the risk management framework is Arturo completing? Question 45 options: A) Continuously monitor security controls B) Implement security controls in IT systems C) Assess security controls for effectiveness D) Categorize information systems