The NIACAP provides a standard set of activities, general tasks, and
a management structure to certify and accredit systems that will maintain the information assurance and security posture of a system or site.
The NIACAP is designed to certify that the information system meets
documented accreditation requirements and will continue to maintain
the accredited security posture throughout the system life cycle.
* Answer CIAP is being developed for the evaluation of critical commercial systems and uses the NIACAP methodology.
* DITSCAP establishes for the defense entities a standard process, set of activities, general task descriptions, and a management structure to certify and accredit IT systems that will maintain the required security posture. The process is designed to certify that the IT system meets the accreditation requirements and that the system will maintain the accredited security posture throughout the system life cycle. The four phases to the DITSCAP are Definition, Verification, Validation, and
Post Accreditation.
* Answer "Defense audit" is a distracter.

There is no method called Review Check. To check input accuracy, data validation and verification checks should be incorporated into appropriate applications.
Character checks compare input characters against the expected type of characters, such as numbers or letters. This is sometimes also known as sanity checking.
Range checks verify input data against predetermined upper and lower limits.
Relationship checks compare input data to data on a master record file.
Reasonableness checks compare input data to an expected standard-another form of sanity
checking.
Transaction limits check input data against administratively set ceilings on specified transactions.
The following answers are incorrect:
The are incorrect because THEY ARE all methods of Input checks
Range check - Verify input against predetermined upper and lower limits
Relationship check - compare input data to data on a master record file
Reasonableness check - compare input data to an expected standard
The following reference(s) were/was used to create this question:
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Software
Development Security ((ISC)2 Press) (Kindle Locations 2554-2558). Auerbach Publications.
Kindle Edition.

The correct answer is "The verification that the claimed identity is valid.". Answer "The presentation of a user's ID to the system" is incorrect because it is an identification act. Answer c is incorrect because authentication can be accomplished through the use of a password. Answer "Only applied to remote users" is incorrect because authentication is applied to local and remote users.

Section: Software Development Security

The reporting process should be centralized else employees won't bother.
The other answers are incorrect because :
They are afraid of being pulled into something they don't want to be involved with is incorrect as
most of the employees fear of this and this would prevent them to report an incident.
They are afraid of being accused of something they didn't do is also incorrect as this also prevents
them to report an incident.
They are unaware of the company's security policies and procedures is also incorrect as
mentioned above.
Reference : Shon Harris AIO v3 , Ch-10 : Laws , Investigatio & Ethics , Page : 675.