ISC2 Exam ISSEP Topic 4 Question 5 Discussion

The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has

been accredited in the Phase 3. The goal of this phase is to continue to operate and manage the

system and to ensure that it will maintain an acceptable level of residual risk. The

process activities of this phase are as follows:

System operations

Security operations

Maintenance of the SSAA

Change management

Compliance validation

Answer option B is incorrect. It is a Phase 3 activity.