You work as a security engineer for BlueWell Inc. According to you, which of the following DITSCAPNIACAP model phases occurs at the initiation of the project, or at the initial C&A effort of a legacy

Question

Options

• APost Accreditation
• BDefinition
• CVerification
• DValidation

• B
  90% (27)
• C
  3% (1)
• D
  7% (2)

Explanation

Definition (Phase 1) is the correct answer because it is explicitly the first phase of the DITSCAP/NIACAP model, triggered at project initiation or when beginning a C&A effort on a legacy system. This phase establishes the System Security Authorization Agreement (SSAA), defines the scope of the C&A effort, and documents the security requirements and responsibilities agreed upon by all stakeholders.

Why the distractors are wrong:

• Verification (C) is Phase 2, occurring during system development to verify that security requirements are being met as the system evolves - not at initiation.
• Validation (D) is Phase 3, occurring after development to validate the fully integrated system meets SSAA requirements before accreditation - well past initiation.
• Post Accreditation (A) is Phase 4, the final phase that begins after the system is already accredited and in operation - the opposite end of the lifecycle.

Memory tip: Think of the acronym DVVP (Definition → Verification → Validation → Post Accreditation) and map it to a project timeline: you Define before you build, Verify while you build, Validate after you build, and Post Accredit once you're live. "Definition" is the only phase that makes logical sense at day zero.

No community discussion yet for this question.