Evaluating: Assess security controls to identify gaps and areas of improvement.
Describing: Document the system, including security controls and configurations.
Testing: Perform validation testing to ensure controls meet security requirements.
Authorizing: Obtain formal approval to operate based on evaluation results and residual risk.
Comparison of Options
B. Evaluating, purchasing, testing, authorizing: Does not include describing, which is critical for documentation.
C. Auditing, documenting, verifying, certifying: Auditing and verifying are part of testing but are incomplete as standalone steps.
D. Discovery, testing, authorizing, certifying: Overlaps with evaluating but lacks specificity for describing.
EC-Council References
Certification and accreditation frameworks (e.g., NIST RMF, ISO 27001) outline these steps for ensuring secure system authorization.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit