Which process ensures a system meets security requirements prior to operation?

• A. Patch management
• B. Accreditation/Authorization
• C. Change control
• D. Risk acceptance

Answer: (B)

Accreditation and authorization provide the formal approval that a system’s security controls have been properly implemented and tested, and that the residual risk is acceptable before the system is allowed to operate. In this process, evidence from the system security plan, testing of controls, and risk assessment is reviewed by an authorizing official who grants an authorization to operate (ATO) under defined conditions. This pre-operation sign-off ensures that security requirements are met and agreed upon before the system goes live, with ongoing monitoring to maintain compliance.

Patch management is about applying updates to fix vulnerabilities and keep software current, not the formal pre-use clearance. Change control governs modifications after deployment to maintain baseline integrity. Risk acceptance is the decision to operate with identified risks, but it doesn’t by itself certify that security requirements are met before operation.