What is a C&A report card?

• A. An annual self-report for FISMA and Privacy Information submitted to the White House Office of Management and Budget
• B. A quarterly vendor risk assessment
• C. A monthly security incident log
• D. A biannual training completion report

Answer: (A)

In federal information security, Certification and Accreditation (C&A) is the process used to verify that a system’s security controls are properly designed, implemented, and tested before the system can operate. The C&A report card is the annual self-assessment agencies prepare to show how well those controls meet FISMA requirements and privacy protections, and it is submitted to the White House Office of Management and Budget for oversight. It communicates the current security posture, any residual risk, and whether the system remains authorized to operate. This makes it the best fit because it directly describes an annual FISMA/privacy compliance report to OMB, whereas the other options describe different, unrelated duties like vendor risk assessments, incident logging, or training tracking.