Examination and analysis of the safeguards required to protect an information system (IS,) as they have been applied in an operational environment, to determine the security posture of that system.