In which of the following DIACAP phases is residual risk analyzed?

Question

Options

• APhase 2
• BPhase 3
• CPhase 5
• DPhase 1
• EPhase 4

• B
  3% (1)
• C
  3% (1)
• D
  6% (2)
• E
  87% (27)

Explanation

Phase 4 (Maintain Authority to Operate and Conduct Reviews) is where residual risk is formally analyzed. After controls have been implemented and validated, Phase 4 focuses on ongoing oversight - including periodic reviews that assess what risk remains after all IA controls are applied. Residual risk analysis is a key activity here because it determines whether the system's security posture still justifies maintaining the Authority to Operate (ATO).

Why the distractors are wrong:

• Phase 1 (D): This is the initiation and planning phase - IA controls are assigned, but no risk analysis has occurred yet.
• Phase 2 (A): Controls are implemented and validated here, but the focus is on meeting requirements, not analyzing leftover risk.
• Phase 3 (B): The certification determination and accreditation decision are made here, but residual risk is reviewed after accreditation is granted, not during the decision itself.
• Phase 5 (C): This is the decommission phase - the system is being retired, so ongoing risk analysis is no longer relevant.

Memory tip: Think "Phase 4 = Maintain & Monitor." Residual risk is what's left over after controls are applied, so it makes sense to analyze it during the maintenance phase, when you're watching over a live, accredited system - not during initial planning or implementation.

No community discussion yet for this question.