she can put pressure on the system developer and increase the likelihood that through security
engineering, the system, by the time it enters formal C&A evaluation, will be inherently more secure,
with fewer residual risks for the accreditor to accept and manage.
77 Edward Schneider and William. A Simpson,“Comprehensive Review of the National Information Assurance