MENU
Which of the following phases of NIST SP 800-37 C&A methodology examines the residual risk for
acceptability, and prepares the final security accreditation package?
The various phases of NIST SP 800-37 C&A are as follows:
Phase 1: Initiation- This phase includes preparation, notification and resource identification. It
performs the security plan analysis,
update, and acceptance.
Phase 2: Security Certification- The Security certification phase evaluates the controls and
documentation.
Phase 3: Security Accreditation- The security accreditation phase examines the residual risk for
acceptability, and prepares the final
security accreditation package.
Phase 4: Continuous Monitoring-This phase monitors the configuration management and control,
ongoing security control verification,
and status reporting and documentation.