One of the most significant challenges faced by government officials today is securing information systems to make them more resilient to attack from increasingly complex challenges from cyber-criminals, state-sponsored groups, and other threats. Over the years, the federal government has developed and implemented Certification and Accreditation (C&A) frameworks to evaluate the effectiveness of the information security infrastructure including technology as well as policies, procedures, and practices. The most prevalent frameworks are the National Industrial Security Program Operating Manual (NISPOM), the Department of Defense (DoD) Information Technology Security Certification and Accreditation Process (DITSCAP), and the DoD Information Assurance Certification and Accreditation Program (DIACAP). But the existence of multiple C&A standards creates confusion and conflict. As a result, implementation can be costly and time consuming. More importantly, security gaps may develop which can be exploited. This dissertation examines the three leading C&A frameworks, develops a statistical model, and presents the argument that a standard can and should be used across the entire spectrum of the C&A process. [The dissertation citations contained here are published with the permission of ProQuest LLC. Further reproduction is prohibited without permission. Copies of dissertations may be obtained by Telephone (800) 1-800-521-0600. Web page: http://www.proquest.com/en-US/products/dissertations/individuals.shtml.]