Which of the following is a C&A phase?

• A. Monitoring
• B. Incident response
• C. Disaster recovery
• D. Training

Answer: (A)

The key idea here is continuous oversight within the Certification and Accreditation process. In FISMA and RMF terms, after a system is authorized, ongoing monitoring (continuous monitoring) keeps evaluating and updating security controls to confirm they continue to meet requirements and operate effectively. This ongoing activity is considered part of the C&A lifecycle because it sustains authorization over time.

The other items fit important security activities, but they aren’t the C&A phase: incident response is about detecting and handling security incidents; disaster recovery focuses on restoring operations after a disruption; training builds awareness and skills. Each is valuable to a strong security program, but they’re not the ongoing authorization/verification activity that defines the C&A phase.