Which two things does SP 800-37 require before an organisation re-enters the RMF at a chosen step? Choose two.

Answer: D. A gap analysis to ensure the risk is acceptable
C. Approval from the authorising official or other relevant decision maker

SP 800-37 states determining the appropriate step requires assessing the system's current state, reviewing activities already completed, identifying a proposed entry step and task, a gap analysis ensuring risk is acceptable, documenting decisions, notifying stakeholders and obtaining approval.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure