DI-ADMN-80239__Information_Systems_Accreditation_Documentation.docx

DATA ITEM DESCRIPTION

Title: INFORMATION SYSTENS ACCREDITATION DOCUMENTATION

Office of Primary Responsibility: A/ASBH-RMT

Applicable Forms: N/A

Use/relationship: This Data Item Description (DID) identifies the format and content requirement covered by the specific and discrete task for the contractor to prepare this data product identified in the contract Statement of Work (SOW).

This DID define the data required to obtain information system accreditation in accordance with AR 380-380, “Automation Security.” Regulation can be obtained from: Command, USAAG Publications Center, 2800 Eastern Blvd., Baltimore, MD 21220-2896.

Application / Interrelationship: This DID contains the format and content preparation instruction for the data product generated by the specific and discrete task requirement for this data included in the contract.

This DID is applicable to all information systems as specified in AR 380-380.

This DID supersedes DI-S-1831.

Requirements:

1. Reference documents. This data is generated by the contract which contains a specific and discrete work task to develop this data product

2. Format. Described below

3. Content. Format and Content shall be described below:

3.1 Section I – Executive Summary

a. Key Vulnerabilities. A summary of key vulnerabilities identified during the risk analysis process and exceptional circumstances pertaining to operating the system(s) in the facility at the stated level. A discussion of actions taken to minimize these risks must be included along with a description of the exceptional circumstances, if any, justifying operation in this environment.

b. Mode of Operation. Describe options and procedures in use at the facility as follows:

(1) Log-on attempts

(2) Procedures, if processing in a lower sensitivity level.

(3) Major software systems, executive, and applications.

(4) Use of data encryption if any.

(5) Security features

(6) Use of local nationals.

c. Waivers Requested. Identify title, number and date of any waivers granted or requested for the information system.

3.2 Section II – Accreditation Objective.

a. Background. Description of relevant events leading to and the objective of this accreditation; the essential nature of the mission and other factors motivating this accreditation, Other operational alternatives (for example, split system, procurement of separate computer) considered prior to selecting this course of action. Rationale for rejecting other operational alternatives.

b. Proposed System Operation. Detailed information concerning features of operational and security modes to be implemented, to include description of system(s) hardware and software, significant applications, and system interfaces.

3.3 Section III – Risk Management Review. Threat identification (all external and internal threats) will include a detailed vulnerability analysis, risk assessment, and countermeasures associated with each threat.

3.4 Section IV – Implementation of Security Controls and Countermeasures.

a. Security Features. Describe in detail the following in existence:

(1) Security Management

(2) Software

(3) Hardware

(4) Procedural

(5) Communications

(6) Personnel

(7) Documentation

(8) Physical and Environmental

b. Implementation Procedures. Describe recommended countermeasures and alternatives, cost and time estimates to implement these measures, milestones, task interdependencies and initial and final operational capabilities.

c. Problem Areas. Identify problems potentially disruptive of system accreditation tasks, processes, and schedules.

3.5 Section V – System(s) Test and Evaluation (ST&E) Plan.

a. Test Requirements. A statement of the purpose, scope, objectives, and requirements of the test.

b. Test Methodology. Identify the following:

(1) Test method to be used.

(2) Investigate and analytical approaches to be used.

(3) Support requirements, if any.

3.6 Appendices. The following appendices shall be included:

a. Glossary containing a list of abbreviations or terms.

b. Additional appendices shall be used to furnish examples, charts, exhibits, flowcharts, and scenario(s) that provide additional supportive data.

4. End of DI-ADMN-80239.