As part of the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), you have identified the different data types and are now determining which security controls would provide the most effective level of protection. What step of the RMF process are you MOST likely working on?