80103r7 1 .pdf

UNCLASSIFIED

NI 8010.3R7 Approved: 22 August 2007 Subgroup: Information Assurance

NGA Instruction for Certification and Accreditation of Information Systems

1. References.

a. Primary. PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary. Secondary references are listed in appendix 1.

2. Purpose. Establish the policy, responsibilities, and procedures for certifying and accrediting all NGA information systems (ISs) and foreign ISs for which NGA is the accrediting authority, according to IC and DoD guidance. This instruction supersedes NI 8010.3R6, same title, 11 April 2006.

3. Policy. DCID 6/3 (appendix 1, reference 4) states the IC’s common understanding of vulnerabilities and risks, and is the standard by which all NGA systems are certified.

NGA implements DCID 6/3 requirements using IC and DoD certification and accreditation (C&A) guidance as models to implement requirements to certify and accredit all classified NGA ISs. Unclassified NGA ISs are subject to the same process and requirements, tailored to the sensitivity of the IS information and infrastructure.

4. Applicability and Scope. This instruction applies to all NGA ISs (regardless of location), organizations, and civilian, military, and contractor personnel involved in the acquisition, development, operation, and maintenance of classified or unclassified ISs.

NGA ISs operating at non-NGA sites are certified and accredited by NGA. The site security authority may impose additional requirements.

5. Definitions. Definitions are located in appendix 2.

6. Responsibilities. The System Security Authorization Agreement (SSAA) principals in the C&A process are the Principal Accrediting Authority (PAA), the Designated Accrediting Authority (DAA), the Project/Segment/Program Manager (PM), the DAA- Representative (DAA Rep), the Information Owner/User Representative, and the Certification Authority (CA). The principals control the certification process.

a. The Director of NGA is the PAA, who has the authority and responsibility for all systems within NGA. The PAA is the security official for the accreditation for all Protection Level (PL) 4 and PL 5 systems.

b. The DAA.

(1) Issues the final accreditation of a system (PL 2-3), which includes the acceptance of the system’s residual risk.

NI 8010.3R7

Certification and Accreditation of Information Systems

(2) Assigns responsibilities to the DAA Rep.

(3) Delegates accreditation authority as necessary for specific systems.

c. The PM, usually located in the Acquisition Directorate (A).

(1) Manages the IS throughout the life cycle including cost, schedule, and performance system development, and after initial operating capability (IOC) transitions the system to the owner for operation.

(2) Initiates the C&A process (drafts the SSAA) and negotiates, at an early stage, which security requirements must be met and which technical security features the IS requires.

(3) Prepares, maintains, and manages the SSAA that properly tracks the IS definition, development, security testing processes, and relevant security requirements.

d. Certification Authority (CA) is the Chief , Office of Chief Information Officer (OCIO), Information Security Management Division (OCIOCS), Information Assurance Branch, Certifications (OCIOCSIC) who conducts the comprehensive initial certification evaluation of the management, operation, and technical security controls in the IS through inspection and formal testing and provides recommended corrective actions to reduce or eliminate system vulnerabilities.

e. DAA-Rep is a technical expert, located in OCIOCS, Accreditations and Risk Analysis (OCIOCSA) who

(1) Ensures that security is integrated into and implemented throughout the system life cycle.

(2) Reports the IS status and meeting of C&A security requirements.

(3) Recommends to the DAA whether or not to accredit a system based on documented residual risk

f. Information Owner/User Representative (User-Rep). The User-Rep represents the IS process owner, user, or user community in requirements definition, design reviews, testing scenarios, and delivery of ISs. The User-Rep is identified through negotiation between the PM and the DAA and may change when the system transitions from development to operations.

g. Director of Enterprise Operations Directorate (E)

(1) Designs, acquires, operates, and maintains NGA’s information technology and services infrastructure.

(2) Maintains adequate security levels for all systems throughout their operational life cycles.

(3) Ensures that the system is operated in accordance with the approved SSAA throughout its life cycle.

h. Director of A.

(1) Designs, acquires, and operates information technology and services infrastructure.

(2) Coordinates with the PM for system transitions from development to operations.

i. Vulnerability assessment team (VAT) and penetration test team (PTT) performs all IS system vulnerability assessments, penetration tests, and other special tests that are used as an independent view of the system’s security state and to find potential exploits in the system architecture.

7. Procedures.

a. The C&A process consists of activities and deliverables culminating in a management decision to operate an IS in the case of an approval to operate (ATO)/approval to connect (ATC), or to not obtain approval to operate. PMs must request an approval to test (ATT) prior to obtaining an ATO/ATC in order to obtain formal approval to test the system. The process ensures security activities are closely integrated into NGA-managed or -owned ISs. Following this process facilitates the final C&A of systems and avoids delays. All systems are held accountable to the C&A process described in DCID 6/3 and this instruction.

Additionally, all systems certified and/or accredited are tracked in a database (XACTA). Each person involved with C&A activities should ensure all documentation is entered into XACTA at appropriate milestones and all approvals are received in order to have a successful, complete C&A.

b. ISs are binned into one of the following categories, which determine the workflow, template, and requirements needed: Enterprise, Industrial, International, Laptops (unclassified and classified), Standalone Workstation, Co- Location, and Alternative.

c. The key to the DCID 6/3 and DoD Information Assurance Certification and Accreditation Process (DIACAP) is the SSAA, an agreement among the five SSAA principals, who own the process and who resolve critical schedule, budget, security, functionality, and performance issues. All information relevant to the C&A process is documented in the SSAA and attachments—for example, the security requirements traceability matrix (SRTM), floor plans, the trusted facility manual (TFM), and test plan and procedures, which may be required to support the C&A process. The SSAA principals, prior to System Requirements Review (SRR), must approve the initial, negotiated SSAA. Details can be found at the CIO website, Information Security Management Division, located on NGANet.

d. SSAA–utility and flexibility. The SSAA principals tailor the SSAA to meet the operational requirements and security policies of the IS and provide prudent risk management strategies for its operation. Other key players, such as Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), IS Security Engineers (ISSEs), and Enterprise Security Engineers (ESEs) support the SSAA principals throughout the IS development process including audits and reviews. The PMs and ISSO/M attend a formal system security registration meeting during which the template and workflow is decided based on into which category the system falls.

e. Recertification of systems. At the time of reaccreditation, or when major modifications are made to the system (for example, change in operating system), re-certification is required. The PM must initiate reviews as part of the readiness procedure. Also, the PM updates the SSAA and presents it to the SSAA principles for renegotiation. The principals must agree on the new level of re-certification effort necessary and all required documentation, reviews, and tests. This agreement considers the level and complexity of all relevant security changes made to the system.

f. C&A for similar systems. The DAA has the discretion to accredit a network of systems within a site if ISs in a group are essentially the same. This approval is still restricted to PL 2 ISs under the purview of a single DAA. The basic security deliverables are still required. The certification process is divided into multiple elements so that the entire site can be accredited as a single entity. Applying this process requires that an accredited network baseline be developed for the site and minor changes be certified as modifications to the baseline. ISs are considered to be “similar systems” if all of the following elements exist:

(1) The PLs and LOCs are the same.

(2) The users have at least the required clearances and access approvals for all information on the ISs.

(3) The ISs are processing the same levels and specific sets of information.

(4) The IS configurations are essentially the same.

(5) The environments of the configurations are essentially the same.

g. Liens. Limitations in resources and technical capabilities may prevent meeting all security requirements without unacceptable delays in operations. All liens must be addressed in the Plan of Action Milestones (POA&M). All exception requests must be submitted to the DAA for approval. The DAA may grant an exception to certain security requirements for a specified period of time under the condition that satisfactory substitutes will be identified and implemented. The POA&M must reflect all granted exceptions including the due date for remediation and way-forward for completing the tasks. Requirements for a written request for an exception are detailed in DCID 6/3 (appendix 1, reference

4) Chapter 9, Paragraph F, Section 1.a.

h. Any system with Category I (CAT I) findings may not obtain an ATT, ATC, or ATO. The PM must correct all findings to the specified requirements prior to beginning the C&A process. For CAT II and below findings, an ATT or ATC may be obtained – however, with liens. An ATC or ATO is not issued for any system that has Category II and below findings without prior approval from the DAA. All liens must be corrected and solutions implemented prior to obtaining an ATC or ATO unless the DAA specifies otherwise with a statement authorizing ATO with liens. In all cases where liens are granted, a POA&M must be provided by the PM, to the ISSO/M, within DAA-specified timeframe.

i. Penetration testing. All PL 4 and 5 systems (and some PL 2-3s, at the DAA’s discretion) must undergo penetration testing. Penetration testing is designed to evaluate the system’s relative vulnerability to hostile attacks by exploiting flaws in system design or implementation in order to circumvent the security features.

PMs must schedule and coordinate the tests with VAT/PEN team.

j. Vulnerability assessment testing. In order to ensure the security of systems, the PM must schedule and coordinate vulnerability assessment testing with the VAT.

This provides an independent view of the state of the system under test to find vulnerabilities in the system architecture. The assessments are required prior to accreditation as well as post accreditation on an annual basis. VAT is not required in standalone ISs.

NI 8010.3R7 Appendix 1

Appendix 1 Secondary References

1. DoD Directive 8500.1, Information Assurance, 24 October 2002.

2. DoD Instruction 8500.2, Information Assurance (IA) Implementation, 6 February 2003.

3. Defense Information Systems Agency, Interim DoD Information Assurance (IA) Certification and Accreditation Process (DIACAP) Guidance, 6 July 2006.

4. DCID 6/3, (U//FOUO) Protecting Sensitive Compartmented Information Within Information Systems, 3 May 2002.

5. NGA PN 8000.2R4, Policy Notice for Protecting Classified Information, Systems, and Infrastructure, 18 May 2005.

NI 8010.3R7 Appendix 2

Appendix 2 Definitions

In this instruction, all DCID 6/3 information or references to the word “intelligence” are replaced with the phrase “classified or sensitive.” This substitution enables DCID 6/3 to apply to all classified and unclassified systems.

1. Accreditation. The official management decision by an DAA for PL 2-3 systems or the PAA for PL 4-5 systems to permit operation of an IS in a specified environment at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural safeguards.

2. Approval to connect (ATC). ATC is approval granted by the DAA (or PAA for PL 4 and PL 5) to the PM based on completion of Certification and Vulnerability Assessment Testing (VAT) (and PEN testing for PL 4-5), specific exit criteria, and documentation.

ATC addresses the connection of a functional component to an accredited system involving the exchange of live or sensitive data.

3. Approval to operate (ATO). ATO is approval granted by the DAA (or by the PAA for PL 4-5) to the PM after successful completion of VAT (and PEN testing for PL 4-5), specific exit criteria, and documentation. ATO usually is granted post-IOC.

4. Approval to test (ATT). ATT is approval granted by DAA representatives or certification authorities (PL 2-3) or the DAA (PL 4-5) to the PM based on completion of specific exit criteria and documentation. ATT usually addresses testing on an isolated system without live or sensitive data and no operational users.

5. Certification. The comprehensive evaluation of the technical and non-technical security features of an IS and other safeguards, made as part of and in support of the accreditation process. A certification is conducted to establish the extent to which a particular design and its implementation meet a specified set of security requirements.

6. Information assurance. Information operations that protect and defend information and ISs by ensuring their availability, integrity, authentication, confidentiality, and nonrepudiation. This includes providing restoration of ISs by incorporating protection, detection, and reaction capabilities.

7. Information system (IS). Any telecommunications or computer related equipment or interconnected system or subsystems of equipment that is used in the acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of voice or data (digital or analog); includes software, firmware, and hardware.

NI 8010.3R7 Appendix 2

8. Operational. A term used to describe an IS that is currently functioning in the capacity for which it is intended or previously defined within its registration or SSAA.

9. Protection level (PL). An indication of the implicit level of trust that is placed in a system’s technical capabilities. A PL is based on the classification and sensitivity of information processed on the system relative to the clearances, formal access approvals, and need-to-know of all direct and indirect users who receive information from the IS without manual intervention and reliable human review.

10. Risk. The expected loss from a given attack or incident. For an attack or defense scenario, risk is assessed as a combination of the following:

a. Threat (expressed as the probability that a given action, attack, or incident will occur, but may also be expressed as frequency of occurrence).

b. Vulnerability (expressed as the probability that the given occurring action, attack, or incident will succeed).

c. Consequence (expressed as some measure of loss, such as dollar cost, resources cost, or programmatic impact).

The total risk of operating a system is assessed as a combination of the risks associated with all possible threat scenarios. Risk is reduced by countermeasures.

11. System Security Authorization Agreement (SSAA). A formal agreement (among the security principals) that is used to guide actions, document decisions, specify IS security requirements, document certification tailoring and levels of effort, identify potential solutions, and maintain operational systems security.