it requires developing and submitting a FISMA Management Plan for approval by the sponsor and then ongoing plan evaluation, refinement, and reporting. The Plan must follow the 6-step risk management ...