Capital Planning and Investment Control entails which of the following?

• A. Integrating Information Security into the CPIC
• B. IT project governance framework
• C. Cybersecurity risk assessment methodology
• D. Cloud migration strategy

Answer: (A)

The main idea here is that security must be built into the Capital Planning and Investment Control process from start to finish. CPIC guides how federal agencies select, fund, manage, and evaluate IT investments to ensure they deliver value while controlling risk. When Information Security is integrated into CPIC, security risks are considered during planning, investment approval, ongoing monitoring, and post-implementation evaluation. This ensures protective controls are planned for, budgeted, and tracked just like other investment factors, rather than being addressed only after a system is deployed.

This integration helps meet policy requirements and aligns security with mission goals, budgets, and timelines, making risk management a continuous part of investment decisions. The other options describe important concepts—an IT project governance framework, a cybersecurity risk assessment method, or a cloud migration strategy—but they do not capture the essential idea that security considerations are embedded directly within the CPIC lifecycle itself.