DOI Assessment & Authorization
OCIO provides Certification and Accreditation services through a proven engagement methodology that ensures customer readiness and efficient delivery, minimizing impact to your technology support teams.
OCIO's Information Systems Security Line of Business Center of Excellence (ISSLOB COE) performs the development, update and review of all required security documentation, provide C&A consultation services to the information system personnel, and performs an independent assessment on the information system to ensure all required system security controls are in place, implemented correctly and operating as intended. All services are implemented in accordance with the guidelines specified within NIST 800-37, Certification and Accreditation.
NIST 800-37 establishes a standard security certification and accreditation process to be used throughout the Federal Government. The NIST process is designed to be adaptable to any type of information system and any computing environment and mission within the government.
Our A&A Services
In the Initiation Phase, the certification agent (OCIO) analyzes the security documentation supporting the information system. The purpose of the initiation phase is to ensure that the Authorizing Official (AO) and the client's Chief Information Security Officer (CISO) are in agreement with the contents of the System Security Plan (SSP). In the Initiation Phase we review:
Security Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation. The purpose of our testing is to determine if the controls are implemented correct, operating as intended and producing the desired control described in the System Security Plan. Activities include:
Security accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls. Activities include:
Customized C&A Services
OCIO offers customized C&A services to include:
- System Development Lifecycle A&A Services Integration
- Pre-Deployment Certification and Accreditation
- System Reauthorization
- In-flight Annual Reviews
- CP/DR Test, Compliance Verification (Optional)
In addition to the basic C&A package, OCIO can provide assistance creating or updating the following:
- A&A Documentation Preparation
- Security Policies
- Security Procedures
- Security Technical Guidelines
- Security Awareness and Training Plan
- Configuration Management Plan
- Patch Management Plan
- Rules of Behavior
- Contingency/Disaster Recovery Plan
- Incident Response Plan
- Continuous Monitoring Plan
No separate contract is required.
No sole source justification is required.
The OCIO ISSLOB COE is positioned to provide C&A services to DOI and federal government agencies. As an OMB designated ISSLOB, work is initiated through an Inter-Agency Agreement (IAA) with the Interior Business Center Line of Business.
The IAA will reference an agreed upon Memorandum of Understanding, with supporting Proposal, Statement of Work and Rules of Engagement documents. Authority Under Which C&A is Provided: Economy Act — 31 USC 1535 and Working Capital Fund, 43 USC 1467, 1468.
For Additional Information:
Please contact the OCIO ISSLOB at ISSLOB@ios.doi.gov or 303-969-5700.