The A&A process in federal information security is a comprehensive assessment and/or evaluation of which aspects?

• A. Policies, technical and non-technical security components, documentation, supplemental safeguards, policies, and vulnerabilities
• B. Physical security controls only
• C. Network architecture drawings exclusively
• D. Financial audits of IT expenditures

Answer: (A)

Assessment and Authorization evaluates the security posture of a federal information system in a holistic way. It looks at policies (the rules and procedures in place), both technical and non-technical security controls (such as encryption, access control, incident response, plus training and personnel security), the documentation that describes the system (like the System Security Plan and risk assessments), any supplemental safeguards added to bolster protection, and identified vulnerabilities or gaps. This broad review supports the authorization decision to operate, ensuring that residual risk is acceptable. It’s not limited to physical security, network diagrams, or financial audits; those narrower activities don’t capture the full security picture.