mitigate identified risks. For a C&A to be truly effective, however, activities to
prepare forthat C&A should begin early in the system development cycle.
Unfortunately, the Federal Information Security Management Act (FISMA)
and the superseded-but-still-used Defense InformationTechnology Security