Which of the following assessment methodologies defines a six-step technical security evaluation?

Question

Options

• AFITSAF
• BOCTAVE
• CFIPS 102
• DDITSCAP

• A
  4% (1)
• C
  93% (26)
• D
  4% (1)

Explanation

FIPS 102 (Federal Information Processing Standard 102) is correct because it explicitly defines a six-step technical security evaluation process for certifying and accrediting computer systems - making "six-step technical security evaluation" a definitional characteristic of this standard.

Why the distractors are wrong:

• FITSAF (Federal IT Security Assessment Framework) is a maturity model that measures security implementation levels across tiers, not a six-step evaluation process.
• OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a risk-based assessment methodology from Carnegie Mellon's CERT focused on organizational risk, not a six-step technical evaluation.
• DITSCAP (DoD Information Technology Security Certification and Accreditation Process) is a DoD C&A framework with four phases, not six steps.

Memory tip: Think "102 = 6 steps" - FIPS 102 is the odd one out among these options because it's a numbered FIPS standard (a technical specification), while FITSAF, OCTAVE, and DITSCAP are all named frameworks/methodologies. On exams, the phrase "six-step technical security evaluation" is essentially a direct definition of FIPS 102.

No community discussion yet for this question.