CERTIFICATION & ACCREDITATION

Subject Home

C&A SECURITY PROCESS
CERTIFICATION AND ACCREDITATION
DITSCAP / NIACAP / NIST 800

^{The Process Of C&A Certification}

Required For Federal Agencies & Connecting/Containing Subcontractors & Non-Federal Entities (including certain State & Local Agencies).   

Click here for C&A background & requirements

What Is Certification And Accreditation?

Security certification and accreditation are important activities that support a risk management process and are an integral part of an agency’s information security program.  Security accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls.

The C&A process aids in and requires:

• Creation of and maintenance of a plan for security;
• Ensure that appropriate officials are assigned security responsibility;
• Review the security controls in their information systems; and
• Authorize system processing prior to operations and periodically thereafter.
• It also employs a third-party auditor/arbitrator concept in the form of the Certifier.

The NIST 800 Approach

The improved NIST Special Publication 800-37 is the first in a series of standards that will be produced during Phase I of the NIST Information System Security Project. The purpose of this publication is to provide guidelines for the security accreditation of information systems supporting the executive agencies of the Federal government, including their contractors.

These guidelines were developed to:

• Enable more consistent, comparable, and repeatable evaluations of security controls applied to federal information systems;

• Promote a better understanding of enterprise-wide mission risks resulting from the operation of information systems;

• Create more complete, reliable, and trustworthy information for authorizing officials---- facilitating more informed security accreditation decisions; and

• Help achieve more secure information systems within the Federal government including the critical infrastructure of the United States.

The guidelines provided in Special Publication 800-37 are applicable to all Federal information systems other than those systems designated as national security systems as defined in 44 U.S.C., Section 3542. The guidelines have been broadly developed from a technical perspective so as to be complementary to similar guidelines issued by agencies and offices operating or exercising control over national security systems. This publication is intended to provide guidelines to Federal agencies in lieu of Federal Information Processing Standards (FIPS) Publication 102, Guidelines for Computer Security Certification and Accreditation, September 1983, which is being rescinded. State, local, and tribal governments as well as private sector organizations comprising the critical infrastructure of the United States are also encouraged or may be required to consider the use of these guidelines, as appropriate.

The C&A Process - see below for our enhanced Certification And Accreditation Process map.

Our Certification & Accreditation Compliance Services

Tim McGuinness, Ph.D. and Associates have a long history of C&A security process experience.  In fact, Dr. McGuinness is both a DISA Certified Approval Authority and Certifier un DITSCAP - The Department of Defense C&A process (click here for more information about DITSCAP) As seasoned security and compliance professionals, they can meet your needs by providing full support for the C&A process, or assist in specific C&A challenges.  The C&A process is unique to each situation, so each project is approached with the team required for that project.  Additionally, many C&A projects overlap upon other regulatory schemas, such as HIPAA, GLBA, and others, and their team can provide leading edge cost-effective compliance solutions in a broad range of regulatory schemas.  Our extensive first hand experience in performing Certification & Accreditation in multiple industry sectors give us unique perspectives into the processes and the challenges created by the approving authorities (agency official), that can be readily applied to your certification project! 

For information of our Certification and Accreditation Security Services, please contact us.

Our Enhanced C&A Certification And Accreditation Process Map Based Upon NIST 800-37 & DITSCAP, and our Experience!
Phase One		Phase One		Phase One
Phase 1 – Task 1		Phase 1 – Task 2		Phase 1 – Task 3
Initiation		Initiation		Initiation
Responsible Party: System Owner		Responsible Party: System Owner		Responsible Party: System Owner
Prepare Documentation		Notify Officials & Identify Resources		Analyze, Update & Accept System Security Plan
Initiation NIST 800-37 Phase 1		Planning NIST 800-37  Phase 3		Multiple NIST 800-37  Phases 4-6
Describe the System Categorize Risks & Vulnerabilities Identify Threats to it Identify its Vulnerabilities Identify In-Place and Planned Security Controls Determine its Initial Risks		Notify Program Officials Identify Resources Needed and Plan execution of Activities Development And Implement Corrective Action Plan		Review Security Categorizations Analyze Security Plan Update Security Plan Obtain Authorizing Official Acceptance of Security Plan Refine Corrective Action Plan
Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:
Responsible Party: Certifier Process Introduction & Certification Planning Develop SSAA Review Available Documentation for Completeness Review Administrative Security/Policies & Procedures Review Security Assessment Plan & Results		Responsible Party: Certifier Status Review & Support, Aid in development of Approving Authority requirements Support Negotiation of Requirements with Approving Official Support Augmentation of Administrative Security Controls		Responsible Party: Certifier Status Review & Support, Review System Security Plan Support Negotiation of Security Plan with Approving Official
Responsible Party: Subcontractor or Internal Internal/External Security Assessments		Responsible Party: Subcontractor or Internal Remediate Known Unacceptable Risks Or Vulnerabilities		Responsible Party: Subcontractor or Internal Remediate Known Unacceptable Risks Or Vulnerabilities
				Responsible Party: Approving Authority/Official Review Security Plan Send Back Security Plan For Remediation If Needed Approve Security Plan
Phase Two		Phase Two		Phase Three
Phase 2 – Task 4		Phase 2 – Task 5		Phase 3 – Task 6
Certification		Certification		Accreditation
Responsible Party Certifier		Responsible Party Certifier		Responsible Party Approving Authority/Official
Assess & Evaluate Security Controls		Document Security Certification		Make Security Accreditation Decision
Integration & Test NIST 800-37 Phase 7		Integration & Test NIST 800-37 Phase 7		Integration & Test NIST 800-37 Phase 7
Prepare Documentation & Supporting Materials Review Methods and Test Procedures Assess & Evaluate In- Place Security Controls Report Security Assessment Results		Provide Findings and Recommendations Assist System Owner Update Security Plan Assist System Owner Prepare Plan of Action & Milestones Assemble Accreditation Package		Determine Final Risk Levels Accept Residual Risk
Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:
Responsible Party: System Owner Review & Approve		Responsible Party: System Owner Review & Approve		Responsible Party Certifier Hand-Off to Approver Answer Approvers Questions / Explain Accreditation Package Contents And How Obtained / Prepared Negotiate On Behalf Of System Owner
Phase Three		Phase Three		Phase Three
Phase 3 – Task 6A		Phase 3 – Task 6B		Phase 3 – Task 7
Remediation		Accreditation		Accreditation
Responsible Party System Owner		Responsible Party Approving Authority/Official		Responsible Party Approving Authority/Official
Mitigate Security Non-Accredited Risks and/or Vulnerability If Required		Make Security Accreditation Decision Again - If Required		Document Security Accreditation
Integration & Test NIST 800-37 Phase 7		Integration & Test NIST 800-37 Phase 7		Integration & Test NIST 800-37 Phase 7
Analyze Official Rejection Develop Mitigation Action Plan Identify Resources Execute MAP Update Documentation & Re-Certify Provide Findings and Recommendations Update Security Plan Prepare Plan of Action & Milestones		Determine Final Risk Levels Accept Residual Risk		Transmit Security Accreditation Package Update Security Plan
Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:
Responsible Party Certifier Assist In Evaluation Of Rejection Assist In Mitigation Action Plan Development Review Revised Security Plan Re-Certify Reassemble Accreditation Package		Responsible Party Certifier Hand-Off to Approver Answer Approvers Questions / Explain Accreditation Package Contents And How Obtained / Prepared Negotiate On Behalf Of System Owner
Responsible Party: Approving Authority/Official Provide Clarifications Identify Additional Approval Criteria
Phase Four				Phase Four
Phase 4 – Task 8		Phase 4 – Task 9		Phase 4 – Task 10
Monitoring		Monitoring		Monitoring
Responsible Party System Owner		Responsible Party System Owner		Responsible Party System Owner
Manage & Control Configuration		Monitor Security Controls		Report & Document Status
O&M NIST 800-37 Phase 9		O&M NIST 800-37 Phase 9		O&M NIST 800-37 Phase 9
Document System Changes Analyze Security Impacts		Select In-Place Security Controls Assess Selected Security Controls		Update Security Plan Update Plan of Action & Milestones Report Status
Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:		Subtasks/Subresponsibilities:
Responsible Party Certifier - As Needed Periodic Change Management Evaluation Periodic Certification & Approval Review Re-Certification As Required		Responsible Party Certifier - As Needed Periodic Change Management Evaluation Periodic Certification & Approval Review Re-Certification As Required		Responsible Party Certifier - As Needed Periodic Change Management Evaluation Periodic Certification & Approval Review Re-Certification As Required
C&A Process Map Copyright © 2004-2005 Tim McGuinness, Ph.D.				End Of Process

For more information about us, please click here.

Please contact us to explore your specific regulatory challenges.  Remember, regulatory deadlines don't wait!  It's the LAW!

Call Us Today! +1-347-412-0574