The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?

During the System Acquisition and Development phase, security requirements including configuration management and control are formally defined, planned, and implemented as part of the certification and accreditation process. This phase is where baseline configurations are established and security controls are integrated into the design and development of the system, making it the appropriate phase to incorporate C&A configuration management tasks per NIST guidance.

System Operations and Maintenance involves ongoing monitoring and change management after deployment, not the initial establishment of configuration management and control baselines required by C&A.

System Initiation is the earliest phase focused on defining the system's purpose, scope, and high-level security categorization, not the detailed configuration management and control activities tied to C&A.

System Implementation focuses on installing and activating the system in the operational environment, which occurs after configuration management and control have already been established in the development phase.