Organizations using RMF Steps 1 through 3, for legacy systems, to confirm that the security categorization has been completed and is appropriate and that the requisite security controls have been selected and allocated to determine if the necessary and sufficient security controls (i.e., system-specific, hybrid, and common controls) have been appropriately selected and allocated can be viewed as a gap analysis
a. True
b. False