Improve your certification and accreditation processes by drawing on these four C&A models

Overview:

Certification and accreditation processes formally evaluate the security of an information system, determine the risk of operating the information system, and then either accept or not accept that risk. There are four primary certification and accreditation models that agencies use as a basis for developing their standardized C&A process: the National Information Assurance Certification and Accreditation Process (NIACAP) model, the National Institute of Standards and Technology (NIST) model, the Defense Information Technology Systems Certification and Accreditation Process (DITSCAP) model, and the DCID 6/3 model. These different methodologies were developed for four different audiences (none within the private sector), but they all have the goal of accomplishing the same task: certifying and accrediting information systems. Therefore, drawing from these four models to develop private sector C&A processes can help businesses achieve compliance with laws (such as Sarbanes-Oxley, HIPAA, and others) that hold private sector enterprises responsible for maintaining basic levels of information security. In this sample chapter from FISMA Certification & Accreditation Handbook, closely study the different types of C&A processes. Chapter coverage includes:

• The NIACAP process
• The NIST process
• DITSCAP
• DCID 6/3
• The common denominator of all C&A methodologies
• C&A for private enterprises

Title: FISMA Certification & Accreditation Handbook
ISBN: 1597491160
Published: November 2006
Authors: Laura Taylor, Matthew Shepherd
Chapter: Chapter 2: Types of Certification and Accreditation
Published by Syngress Publishing

(Is this item miscategorized? Does it need more tags? Let us know.)