What is an information assurance (IA) accreditation/authorization process?

• A. An informal check after deployment
• B. A formal assessment process to ensure a system meets security requirements before operation
• C. A training course
• D. A grant process for budgets

Answer: (B)

A formal, risk-based evaluation of a system’s security controls that culminates in an authorization to operate before the system goes live. This process collects and reviews evidence, tests controls, and examines documentation like the System Security Plan to ensure the system meets defined security requirements. An official authorization decision is then made by an authorizing official, accepting any residual risk at an appropriate level. This makes it clearly different from an informal post-deployment check, a training course, or a budget grant process.