Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?

Question

Options

• ADefinition, Validation, Verification, and Post Accreditation
• BVerification, Definition, Validation, and Post Accreditation
• CVerification, Validation, Definition, and Post Accreditation
• DDefinition, Verification, Validation, and Post Accreditation

• A
  3% (1)
• B
  6% (2)
• C
  3% (1)
• D
  87% (27)

Explanation

DITSCAP (DoD Information Technology Security Certification and Accreditation Process) follows a strict four-phase sequence: Definition → Verification → Validation → Post Accreditation, making D correct. The process logically starts by defining the system's security requirements and boundaries, then verifying the design meets those requirements, then validating the fully implemented system actually works as secured, and finally entering Post Accreditation for ongoing operations.

Why the distractors fail:

• A swaps Verification and Validation - you can't validate an unbuilt system before you verify the design.
• B starts with Verification before Definition - you can't verify requirements that haven't been defined yet.
• C places Definition third, which breaks the entire foundation-first logic of any security framework.

Memory tip: Use the acronym "Don't Validate Very Poorly" reversed - or just think of it as building a house: you Define the blueprint, Verify the construction matches it, Validate the finished house is livable, then maintain it (Post Accreditation). You'd never inspect before designing.

No community discussion yet for this question.