What completes the acronym C&A in the context described?

• A. Certification and Accreditation
• B. Compliance and Assurance
• C. Cybersecurity and Access
• D. Control and Authorization

Answer: (A)

In this context, C&A means Certification and Accreditation—the formal process used to obtain authorization to operate a system. Certification is the independent assessment that security controls are properly implemented and operating as intended. Accreditation is the formal approval by an authorizing official to operate the system, based on the certification results and the accepted level of risk.

This pair is the standard terminology in federal info security (FISMA/NIST RMF) for moving a system from development to live operation: you first verify the controls (certification), then you grant official permission to operate (accreditation). The other phrases don’t represent the established process used in this framework.