To whom do agency C&A report cards are submitted?

• A. White House Office of Management and Budget
• B. Congressional committee on security
• C. Department of Homeland Security
• D. The general public

Answer: (A)

In federal information security oversight, agencies must report the outcomes of their Certification and Accreditation activities to a central executive-branch office. The White House Office of Management and Budget handles this annual C&A reporting, using the buildup from each agency to monitor compliance, inform policy, and guide budget decisions. Congress may receive separate updates, and the Department of Homeland Security collaborates on cybersecurity matters, but the formal submission path for these C&A report cards is to OMB. The general public does not receive these internal security reports.