Which CPIC-related exhibit is explicitly mentioned as part of the process?

• A. Submit Exhibit 300s, Exhibit 53
• B. Create a security incident response plan
• C. Develop a vulnerability management program
• D. Draft a cloud strategy

Answer: (A)

CPIC relies on standardized documents to govern IT investments, ensuring each investment is justified, tracked, and aligned with agency goals. Two exhibits are explicitly used in this process: Exhibit 300s gather the investment’s mission need, cost, benefits, risks, and performance measures to justify and monitor the project over its lifecycle; Exhibit 53 provides the cost, schedule, and performance information that ties the investment to the agency budget and strategic plan. Together, they supply the governance data agencies need to approve, track, and manage IT investments. The other options describe important security planning or strategy activities, but they are not the CPIC exhibits used to document and oversee IT investments.