Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into production? Each correct answ

NIST provides the frameworks and guidelines (such as SP 800-37) that support C&A processes but does not itself mandate or enforce certification requirements on agencies.

FIPS (Federal Information Processing Standards) establish technical standards for cryptography and data handling but do not mandate the C&A process itself before production.

FISMA (Federal Information Security Management Act) legally requires all federal information systems, including general support systems and major applications, to undergo certification and accreditation before going into production, as part of a risk management framework.

OMB (Office of Management and Budget) Circular A-130 reinforces this requirement by directing agencies to ensure C&A is completed prior to production deployment, complementing FISMA's statutory mandate.