A security evaluation report and an accreditation statement are produced in which of the following phases of the system development life cycle?

Question

Options

• Aproject initiation and planning phase
• Bsystem design specification phase
• Cdevelopment & documentation phase
• Dacceptance phase

• A
  2% (1)
• B
  2% (1)
• C
  2% (1)
• D
  93% (40)

Explanation

Acceptance phase (D) is correct because this is when the completed system undergoes formal security testing and evaluation before being authorized for operational use - the security evaluation report documents the findings, and the accreditation statement is the official authorization to operate.

Why the distractors are wrong:

• (A) Project initiation and planning is too early - security requirements may be identified here, but no system exists yet to evaluate or accredit.
• (B) System design specification focuses on architectural decisions and security controls to be built, not on producing formal evaluation reports.
• (C) Development & documentation is when the system is being built and tested internally; formal accreditation happens after development is complete, not during it.

Memory tip: Think of accreditation as the "green light to go live" - it logically comes at the acceptance phase, right before the system enters production, because you can only officially approve something that is fully built and tested.

No community discussion yet for this question.