Which outcome meets the CSRDA requirement?

• A. It facilitated development of security checklists by NIST through the National Checklist Program for IT products.
• B. CSRDA mandated the creation of the National Institute of Standards and Technology’s Encryption Standards.
• C. CSRDA established the Federal Information Processing Standards only for hardware.
• D. CSRDA required annual audits of IT products.

Answer: (A)

The key idea is that CSRDA drives the creation of practical, reusable security guidance for IT products by leveraging NIST’s National Checklist Program. This program develops security configuration checklists that specify how products should be configured to meet security requirements, providing a common, auditable baseline for agencies to follow. CSRDA aligning with this process makes sense because it promotes standardized, repeatable security configurations rather than focusing on encryption standards, hardware-only standards, or audits. The other possibilities describe activities (encryption standards, hardware-specific standards, annual audits) that aren’t what CSRDA is described as promoting through the National Checklist Program.