What do the initials C&A stand for in the context of FISMA?

• A. Certification and Accreditation
• B. Compliance and Assessment
• C. Certification and Authorization
• D. Conformance and Assurance

Answer: (A)

In FISMA, the initials stand for Certification and Accreditation. Certification is the formal evaluation of the system’s security controls to confirm they are properly implemented and work as intended, based on testing and documentation. Accreditation is the official management authorization to operate the system, granted by the designated Authorizing Official after the certification results show an acceptable level of risk. Together, these steps establish that a federal system has been assessed and deemed fit to run with appropriate risk controls in place before it processes or stores government data. The other word pairs aren’t the standard terminology used in this context, and while you might see similar ideas described in newer RMF materials (such as Certification and Authorization), the traditional FISMA terminology is Certification and Accreditation.