FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that…

FITSAF Level 2 indicates that procedures and controls are documented, but not yet implemented.

FITSAF Level 5 represents full integration of procedures and controls into a comprehensive security program with continuous improvement.

FITSAF Level 4 indicates that procedures and controls have been tested and reviewed, which goes beyond mere implementation.

FITSAF Level 1 indicates that an information security policy exists but procedures are not yet documented or implemented.

In the Federal Information Technology Security Assessment Framework, Level 3 specifically represents the stage where documented procedures and controls have been implemented within the organization's systems. This level sits between Level 2 (procedures and controls documented) and Level 4 (procedures and controls tested and reviewed), marking the transition from paper-based policy to operational reality. Reaching Level 3 demonstrates that security requirements are actively applied, not merely recorded.