You work as a security manager for BlueWell Inc. You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined…

The NIST SP 800-37 Certification and Accreditation (C&A) methodology is structured into four phases. The Initiation Phase is the first phase, where the groundwork for the C&A process is established. A fundamental task within this phase is the security categorization of the information system. This is performed in accordance with FIPS 199, which involves determining the potential impact (low, moderate, or high) on organizational operations and assets should the confidentiality, integrity, or availability of the information be compromised. This categorization is a critical first step as it directly influences the selection of the appropriate security control baseline for the system in subsequent phases.

A. Continuous Monitoring: This is the final phase, which involves ongoing monitoring of security controls after the system has been accredited, not the initial categorization.

C. Security Certification: This phase involves the assessment of security controls that were selected based on the security categorization determined during the Initiation phase.

D. Security Accreditation: This is the official management decision to authorize system operation, which occurs after the certification activities are complete and risk is evaluated.

1. National Institute of Standards and Technology (NIST). (May 2004). Special Publication 800-37

Guide for the Security Certification and Accreditation of Federal Information Systems. Section 3.1

"Phase 1: Initiation Phase

" Task 1-2 Security Categorization

p. 16. "The security categorization for the information system is determined in accordance with FIPS 199."

2. National Institute of Standards and Technology (NIST). (February 2004). Federal Information Processing Standards Publication 199 (FIPS PUB 199)

Standards for Security Categorization of Federal Information and Information Systems. Section 3

"Security Categorization

" p. 3. This document defines the process of categorization that is executed during the Initiation phase of the C&A process.

3. Ross

R.

Katzke

S.

Johnson

A.

Swanson

M.

& Stoneburner

G. (April 2010). NIST Special Publication 800-37

Revision 1

Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Figure 2-1

"The Risk Management Framework

" p. 11. While this is a later revision

it clearly shows "Categorize Information System" as the first step in the RMF

which evolved from the C&A process's Initiation phase.