documentation exercises. Reviews and evaluations still begin late in the system
life cycle; none of the C&A methodologies cited here include security reviews
of the system design or code reviews during system implementation. The code
reviews that do occur are solely at the Designated Approving Authority’s (DAA)