Which of the following lists the four phases of the C&A process?

• A. Initiation, Certification, Accreditation, Monitoring
• B. Initiation, Evaluation, Accreditation, Monitoring
• C. Initiation, Certification, Authorization, Monitoring
• D. Planning, Certification, Accreditation, Monitoring

Answer: (A)

The four phases of the C&A process are Initiation, Certification, Accreditation, and Monitoring. Initiation sets up the effort by defining the system, its security requirements, scope, and the plan for evaluating controls. Certification is the rigorous assessment phase where independent evaluators test and verify that security controls meet the defined requirements and gather evidence. Accreditation is the formal management decision to authorize the system to operate, accepting the residual risk. Monitoring is ongoing oversight to detect changes, reassess risk, and ensure controls remain effective over time. The other options mix terms that don’t align with the standard C&A terminology—Evaluation, Planning, and Authorization don’t fit the established sequence as cleanly as Initiation, Certification, Accreditation, and Monitoring.