Federal IT Security Professional (FITSP) Operator Practice Test

The main idea being tested is setting up the risk management effort. The RMF Prepare step is about framing the context and securing the resources needed to manage risk. In this phase you define the mission and business context, establish the system's boundaries and the authorization boundary, determine risk tolerance, and assign roles and responsibilities. You also secure the necessary resources—personnel, budget, tools—and develop the plan and documentation (like the risk management strategy and System Security Plan) that guide the rest of the RMF activities. This preparation provides the foundation for later steps such as categorizing, selecting and implementing controls, assessing them, obtaining authorization to operate, and continually monitoring.