sooner than later

7.

Authorize

A. Information systems and internal information are grouped based on impact. 

8.

Supplement

B. The step where an initial set of security controls for the information system are chosen and tailored to obtain a starting point for required controls  

9.

Monitor

C. Assess the risk and local conditions, including the security requirements, specific threat information, and cost–benefit analysis to increase or decrease security controls. 

10.

Categorize

D. Step where the original and supplement controls are put in writing

11.

Document

E. Original and supplement controls are applied to the system.

12.

Select

F. Security controls are evaluated to see if they are implemented correctly and are operating as intended.

13.

Assess

G. Evaluation of risk to organizational operations, organizational assets, or individuals that leads to this action

14.

Implement

H. Requires checking and assessing the selected security controls in the information system on a continuous basis