Department of Defense Information Assurance Certification and Accreditation Process

The DoD Information Assurance Certification and Accreditation Process (DIACAP) is a United States Department of Defense (DoD) process that means to ensure that companies and organizations apply risk management to information systems (IS). DIACAP defines a DoD-wide formal and standard set of activities, general tasks and a management structure process for the certification and accreditation (C&A) of a DoD IS that maintains the information assurance (IA) posture throughout the system's life cycle.

NOTE: As of March 12, 2014(though the official transition will take place as of May 2015), the DIACAP is to be replaced by the "Risk Management Framework (RMF) for DoD Information Technology (IT)" Although re-accreditations continue through late 2016, systems that have not yet started accreditation by May 2015 will transition to RMF processes.[1] The DoD RMF aligns with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF).[2][3]

History

DIACAP resulted from a NSA directed shift in underlying security approaches. An interim version of the DIACAP was signed July 6, 2006, and superseded the interim DITSCAP guidance. The final version is called Department of Defense Instruction 8510.01, and was signed on March 12, 2014 (previous version was November 28, 2007).

DODI 8500.01 Cybersecurity http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf,

DODI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

DIACAP differs from DITSCAP in several ways—in particular, in its embrace of the idea of information assurance controls (defined in DoDD 8500.1 and DoDI 8500.2) as the primary set of security requirements for all automated information systems (AISs). IA Controls are determined based on the system's mission assurance category (MAC) and confidentiality level (CL).

Process

References

  1. ↑ "DoDI 8510.01 "Risk Management Framework (RMF) for DoD Information Technology (IT)" March 14th 2014" (PDF). Retrieved 29 March 2014.
  2. ↑ "NIST Risk Management Framework".
  3. ↑ "NIST:Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach".


This article is issued from Wikipedia - version of the Monday, December 21, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.