In which of the following DIACAP phases is residual risk analyzed

Phase 4 of the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP), "Maintain Authorization to Operate and Conduct Reviews," is where residual risk is analyzed on an ongoing basis. This phase encompasses continuous monitoring of the information system's security controls and posture throughout its lifecycle. Activities include performing annual reviews, assessing the impact of system changes, and responding to new threats or vulnerabilities. Each of these activities requires a re-analysis of the residual risk to ensure it remains at an acceptable level as determined by the Authorizing Official (AO), thereby maintaining the system's security authorization.

A. Phase 2: This phase focuses on implementing and validating controls. It generates the data for the residual risk calculation, but the primary analysis occurs later.

B. Phase 3: This phase involves the Authorizing Official's final review of the certification package and the documented residual risk to make an accreditation decision, not the ongoing analysis.

C. Phase 5: This phase concerns the secure shutdown and disposal of a system; risk analysis here focuses on data remanence and media sanitization, not operational risk.

D. Phase 1: This phase involves the initial planning and high-level risk assessment to scope the effort, not the detailed analysis of residual risk after controls are implemented.

1. Department of Defense Instruction (DoDI) 8510.01

"Information Assurance (IA) Certification and Accreditation (C&A) Process (DIACAP)" (November 28

2007). Enclosure 4

Section E4.4

"Phase 4 - Maintain Authorization to Operate and Conduct Reviews

" states: "The system IA posture shall be reassessed to determine if the risk is still acceptable... The review shall include... an updated risk assessment of the system." This explicitly places ongoing risk assessment and analysis in Phase 4.

2. O'Neal

M. S. (2009). A Systems Engineering Approach to the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) [Master's thesis

Naval Postgraduate School]. In Chapter IV

Section D

"Phase 4: Maintain Authorization to Operate and Conduct Reviews

" the author states

"Phase 4 is the continuous monitoring of the system’s security posture... This requires periodic risk assessments to re-evaluate the system’s security posture and determine if the residual risk is still acceptable." (p. 41).

3. NIST Special Publication 800-37

Revision 2

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (December 2018). While describing the RMF which superseded DIACAP

its principles are foundational. Step 6

"Monitor

" which directly maps to DIACAP Phase 4

is defined by "maintaining ongoing situational awareness of the security and privacy posture of the system... to determine if the risk... remains acceptable." (Section 2.8

p. 21). This reinforces the concept of continuous risk analysis in the maintenance phase.