Directive (DCID) 6/3; and National Institute of Standards and Technology
(NIST), Special Publication (SP) 800-64, Security Considerations in the
Information System Development Life Cycle (which maps FISMA-driven C&A
activities described in NIST SP 800-37, Guide for the Security Certification