The primary outcome of a certification process is that it provides documented security analyses needed to make a risk-based decision. Certification is a process of evaluating and testing the security of a system or product against a set of criteria or standards. Certification provides evidence of the security posture and capabilities of the system or product, as well as the identified vulnerabilities, threats, and risks. Certification helps the decision makers, such as the system owners or accreditors, to determine whether the system or product meets the security requirements and can be authorized to operate in a specific environment12 References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, p. 455; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 7: Security Operations, p. 867.