E3.5. Phase 3, Validation. Phase 3 process activities, shown
in figure E3-10, validate that the preceding work has produced an information
system that operates in a specified computing environment with an acceptable
level of residual risk. This phase consists of process activities that occur
after the system is integrated and culminates in the accreditation of the IT
system. Phase 3 includes a review of the SSAA, an evaluation of the integrated
IT system, certification, and accreditation.