Which NIST Special Publication defines CPIC?

• A. NIST SP 800-35
• B. NIST SP 800-36
• C. NIST SP 800-64
• D. NIST SP 800-65

Answer: (D)

CPIC is the formal process for security assurance and authorization of federal information systems, and NIST Special Publication 800-65 provides the guidelines that define and describe this process. That publication details how assessment, authorization, and ongoing monitoring come together to ensure a system meets security requirements before it operates and throughout its life cycle. The other publications focus on different areas—risk assessment, policy and risk management, and integrating security into the software development life cycle—so they do not define CPIC.