The phase 3 of the Risk Management Framework (RMF) process is known as mitigation
planning. Which of the following processes take place in phase 3? Each correct answer
represents a complete solution. Choose all that apply.

A.
Identify threats, vulnerabilities, and controls that will be evaluated.

B.
Document and implement a mitigation plan

C.
Agree on a strategy to mitigate risks.

D.
Evaluate mitigation progress and plan next assessment.