CAP · Question #405
Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or…
The correct answer is A. Accreditation is the official management decision given by a senior agency official to authorize D. Certification is a comprehensive assessment of the management, operational, and technical. In the NIST/FISMA framework for Certification and Accreditation (C&A), the two terms have distinct and specific meanings that are commonly tested and often confused: Certification (Answer D - TRUE): Certification is the comprehensive assessment of the management, operational…
Question
Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation? Each correct answer represents a complete solution. Choose two.
Options
- AAccreditation is the official management decision given by a senior agency official to authorize
- BAccreditation is a comprehensive assessment of the management, operational, and technical
- CCertification is the official management decision given by a senior agency official to authorize
- DCertification is a comprehensive assessment of the management, operational, and technical
How the community answered
(22 responses)- A86% (19)
- B9% (2)
- C5% (1)
Explanation
In the NIST/FISMA framework for Certification and Accreditation (C&A), the two terms have distinct and specific meanings that are commonly tested and often confused:
Certification (Answer D - TRUE): Certification is the comprehensive assessment of the management, operational, and technical security controls in an information system. It is performed to determine the extent to which controls are implemented correctly, operating as intended, and producing the desired outcome relative to the system's security requirements. This is a technical and analytical activity.
Accreditation (Answer A - TRUE): Accreditation is the official management decision given by a senior agency official (the Authorizing Official/Designated Approving Authority) to authorize operation of an information system and explicitly accept the risk to agency operations. This is a formal authorization activity.
Why B and C are wrong:
- B incorrectly assigns the 'comprehensive assessment' definition to Accreditation - that definition belongs to Certification.
- C incorrectly assigns the 'official management decision' definition to Certification - that definition belongs to Accreditation.
Memory tip: Think of it this way - you certify (verify/assess) something technically first, then an executive accredits (officially approves) it. Certification → assessment; Accreditation → authorization decision.
Topics
Community Discussion
No community discussion yet for this question.