Title: Information Systems Security Certification and Accreditation
Course: IN 2001 Principle of Information Assurance > Section: Module 10: Chapter 10

Information Systems Security Certification and Accreditation
1. It may seem that only systems handling secret government data require security certification or accreditation.
2. Organizations are increasingly finding that in order to comply with the myriad of new federal regulations protecting personal privacy, their systems need to have some formal mechanism for verification and validation.

Certification Versus Accreditation
1. In security management, accreditation authorizes an IT system to process, store or transmit information.
2. Certification is defined as “the comprehensive evaluation of the technical and nontechnical security controls of an IT system to support the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements.”
3. Organizations pursue accreditation or certification to gain a competitive advantage or to provide assurance or confidence to their customers.

NIST SP 800-37: Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach
1. NIST SP 800-37 states that “The security certification and accreditation process consists of four distinct phases:
  - Initiation Phase
  - Security Certification Phase
  - Security Accreditation Phase
  - Continuous Monitoring Phase

NSTISS Instruction-1000: National Information Assurance Certification and Accreditation Process (NIACAP)
1. National Security Interest Systems have their own security certification and accreditation standards. National Information Assurance Certification and Accreditation Process (NIACAP), establishes the minimum national standards for certifying and accrediting national security systems.
2. The NIACAP is designed to certify that the IS meets documented accreditation requirements and will continue to maintain the accredited security posture throughout the system life cycle.

ISO 27001/27002 Systems Certification and Accreditation
1. Entities outside the United States apply the standards provided under the International Standards Organization standard ISO 27001and 27002.
2. Organizations wishing to demonstrate their systems have met this international standard must follow the certification process.