such as systems, networks, and application life cycles. In short, the C&A process
audits and ensures policies, procedures, controls, and contingency planning.
While some information security reports can be obtained about systems from
various forms of testing (penetration tests and code reviews), this level of