Which statement best describes NIST Risk Management Framework?

A. sharing passwords publicly B. categorize, select, implement, assess, authorize, and monitor C. treating all information as public D. bypassing management approval