In FISMA, ________ is done internally by the organization.

• A. Certification
• B. Accreditation
• C. Both A and B
• D. Neither A nor B

Answer: (C)

Under FISMA, the organization handles the full Certification and Accreditation process to obtain authorization to operate. Certification means testing and evaluating security controls to verify they meet required standards, usually documented in a Security Assessment Report. Accreditation is the formal management authorization to operate the system, based on the certification results and risk assessment, granted by the designated Authorizing Official. Because both steps are managed within the organization as part of its security program, both certification and accreditation are done internally. The other options don’t fit because FISMA requires the complete C&A process, not just one part or neither.