hahrFHFS8091 hahrFHFS8091 02-01-2023 Law Answered Applying the first three steps in the rmf to legacy systems can be viewed in what way to determine if the necessary and sufficient security controls have been appropriately selected and allocated?