Which NIST Special Publication covers CPIC?

• A. 800-65
• B. 800-64
• C. 800-35
• D. 800-70

Answer: (A)

CPIC is the process federal agencies use to certify and accredit information systems before they are allowed to operate. NIST Special Publication 800-65 provides the official guidelines for carrying out that process, detailing the steps, roles, required documentation, and lifecycle activities involved in certification and accreditation. This makes it the most appropriate reference for CPIC because it directly describes how to authorize and maintain approval to operate a system from a security perspective. The other publications focus on different aspects—security considerations in the system development life cycle, security testing and assessment, and the National Checklist Program for IT products—so they don’t specifically address the CPIC process in the same way.