According to NIST SP 800-37,which of the Following Is the First

Multiple Choice

According to NIST SP 800-37,which of the following is the first step in the security controls selection process?

A) Categorize the information system and the information processed
B) Select an initial set of baseline security controls
C) Assess the security controls using appropriate assessment procedures
D) Authorize information system operation based on risk determination