Which of the following guidance documents is useful in determining the impact level of a
particular threat on agency systems?

Tom is the project manager for his organization. In his project he has recently finished the

risk response planning. He tells his manager that he will now need to update the cost and
schedule baselines. Why would the risk response planning cause Tom the need to update
the cost and schedule baselines?

Which of the following RMF phases is known as risk analysis?