FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that t

Level 2 ('Documented') indicates that security procedures and controls have been formally written down, but it does not confirm that they have been deployed or are actively functioning.

FITSAF Level 3, termed 'Implemented,' signifies that the security procedures and controls, which were previously documented and designed, have now been successfully put into active operation within the information system.

Level 5 ('Measured') means that implemented controls are not only operational but are also continuously monitored, evaluated, and improved, which is a stage beyond mere implementation.

Level 1 ('Defined') suggests that the organization has identified the general need for security controls but has not yet developed or documented specific procedures.

Level 4 ('Tested') implies that the implemented controls have undergone formal testing and evaluation to ensure their effectiveness, which is a step further than simply being implemented.