Which of the following processes provides a standard set of activities, general tasks, and a management structure to certify and accredit systems…

The National Information Assurance Certification and Accreditation Process (NIACAP) was established to provide a minimum standard framework for certifying and accrediting the security of national security systems across the U.S. government. It defined a standard set of activities, general tasks, and a management structure to ensure systems maintained a consistent information assurance (IA) posture. NIACAP's purpose was to create a common foundation for the C&A process, promoting reciprocity and a uniform approach to managing risk for systems that store, process, or communicate sensitive information.

A. ASSET (Automated Security Self-Evaluation Tool) was a software tool used for self-assessment against security policies, not a comprehensive C&A management process.

B. NSA-IAM (National Security Agency Information Assurance Methodology) is a methodology for evaluating the IA posture of a network, not a complete C&A process with a defined management structure.

D. DITSCAP (DoD Information Technology Security Certification and Accreditation Process) was a C&A process specific to the Department of Defense, whereas NIACAP was the broader standard for all national security systems.

---

1. National Security Telecommunications and Information Systems Security Committee. (2000). National Information Assurance Certification and Accreditation Process (NIACAP) (NSTISSI No. 1000). The abstract and Section 3

"Policy

" state that the instruction establishes a standard national process for C&A

defining its activities and structure.

2. National Institute of Standards and Technology. (2014). Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (NIST Special Publication 800-37

Revision 1). Appendix G

page G-1

describes the historical evolution from legacy C&A processes

explicitly identifying NIACAP as the "National Information Assurance Certification and Accreditation Process."

3. Ross

R.

et al. (2008). Security Assessment and Authorization for U.S. Information Systems. IEEE Security & Privacy

6(3)

17-19. https://doi.org/10.1109/MSP.2008.73. The article discusses the evolution of C&A processes

mentioning NIACAP as a key predecessor to the unified Risk Management Framework (RMF).