ISC2 ISSEP Exam - Topic 4 Question 4 Discussion

Certification and accreditation (C&A) is a set of processes that culminate in an agreement between key players that a system in its current configuration and operation provides adequate protection controls.

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is

a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a

system is in operation. The C&A process is used extensively in the U.S. Federal Government. Some

C&A processes include FISMA, NIACAP, DIACAP, and DCID 6/3.

Certification is a comprehensive assessment of the management, operational, and technical security

controls in an information system, made in support of security accreditation, to determine the

extent to which the controls are implemented correctly, operating as intended, and producing the

desired outcome with respect to meeting the security requirements for the system.

Accreditation is the official management decision given by a senior agency official to authorize

operation of an information system and to explicitly accept the risk to agency operations (including

mission, functions, image, or reputation), agency assets, or individuals, based on the implementation

of an agreed-upon set of security controls.

Answer option B is incorrect. Risk management is a set of processes that ensures a risk-based

approach is used to determine adequate, cost-effective security for a system.

Answer option D is incorrect. Information assurance (IA) is the process of organizing and monitoring

information-related risks. It ensures that only the approved users have access to the approved

information at the approved time. IA practitioners seek to protect and defend information and

information systems by ensuring confidentiality, integrity, authentication, availability, and non-

repudiation. These objectives are applicable whether the information is in storage, processing, or

transit, and whether threatened by an attack.

Answer option C is incorrect. ISSE is a set of processes and solutions used during all phases of a

system's life cycle to meet the system's information protection needs.