CAP · Question #26
System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process. What are the different phases of…
The correct answer is A. Pre-certification B. Certification D. Authorization E. Post-Authorization. The System Authorization Plan (SAP) follows four defined phases; Post-certification is not one of them.
Question
System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process. What are the different phases of System Authorization Plan? Each correct answer represents a part of the solution. Choose all that apply.
Options
- APre-certification
- BCertification
- CPost-certification
- DAuthorization
- EPost-Authorization
How the community answered
(54 responses)- A87% (47)
- C13% (7)
Why each option
The System Authorization Plan (SAP) follows four defined phases; Post-certification is not one of them.
Pre-certification is the first phase of the SAP, where documentation and security controls are prepared before formal review.
Certification is the second phase, involving the formal technical evaluation of the system's security controls.
Post-certification is not a defined phase in the System Authorization Plan; the process moves directly from Certification to Authorization.
Authorization is the third phase, where an authorizing official reviews certification results and grants or denies authority to operate (ATO).
Post-Authorization is the final phase, covering ongoing monitoring and maintenance of the system's authorization status.
Concept tested: System Authorization Plan (SAP) phases under FISMA
Source: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.