In which of the following DIACAP phases is residual risk analyzed?

Phase 1 is the Initiation phase, where the system is registered and the DAA is appointed, not where residual risk is analyzed.

Phase 5 is the Maintain Accreditation phase, focused on continuous monitoring and re-accreditation, not initial residual risk analysis.

Phase 2 is the Implementation phase, where security requirements are applied to the system.

In the DIACAP (Department of Defense Information Assurance Certification and Accreditation Process) methodology, residual risk is analyzed in Phase 4, the Certification phase. During this phase, the certifying authority reviews the security posture, including the implemented controls and any remaining or residual risks, to determine if the system is ready for accreditation.

Phase 3 is the Validation phase, where security controls are validated for effectiveness.