FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information…

FITSAF defines five maturity levels.

• Level 1 – policy drafted;

• Level 2 – policy and procedures documented;

• Level 3 – security controls implemented and functioning;

• Level 4 – procedures and controls are tested, reviewed, and corrective actions tracked;

• Level 5 – security management is integrated with enterprise-wide processes and subject to continuous improvement.

Because Level 4 is explicitly characterized as “tested and reviewed,” it is the only level that satisfies the question’s requirement.

B. Level 5 focuses on enterprise integration and continuous improvement, not merely the testing/review of controls.

C. Level 1 contains only documented policy; nothing is implemented or tested.

D. Level 2 documents procedures but has no implementation or testing activities.

E. Level 3 has controls implemented and operating, but formal testing and periodic reviews have not yet been performed.

1. Federal CIO Council. “Federal Information Technology Security Assessment Framework (FITSAF)”

Version 1.1

28 Nov 2000

Section 3

p. 5-6: Level 4—“Tests and reviews of security controls and procedures are performed.”

2. NIST Special Publication 800-26

“Security Self-Assessment Guide for Information Technology Systems”

Nov 2001

Appendix A

p. 16: Level 4—“Security controls and procedures have been tested and reviewed; deficiencies are tracked.”

3. Carnegie Mellon Univ.

Heinz College course 95-702 “Information Security Management”

Lecture notes 7

slide 12 (2023): FITSAF maturity table—Level 4 described as “tested & reviewed.”