SP 800-37 Rev 2, RMF: A System Life Cycle Approach for Security and Privacy
If, however, there are significant deficiencies, the AO can return the plan to the information system owner or common control provider for corrections. Based on this authorization, the level of continuous monitoring and frequency for each control is defined, allowing the system developers and engineers to begin incorporating the monitoring plan into the system development [...]