A rugged, whitewater river flowing northward through deep canyons, the New River is among the oldest rivers on the continent. New River Gorge National River in West Virginia encompasses over 70,000 acres of land along the New River, is rich in cultural and natural history, and offers an abundance of scenic and recreational opportunities.
Big Southern Butte is one of two domes rising from a sea of basalt near the center of the eastern Snake River Plain in Idaho. The butte is one of the largest volcanic domes in the world, but at 300,000 years old it is also one of the youngest. Hikers who trek to the 7,550-foot high summit are rewarded with spectacular panoramic views. Photo by Devin Englestead, BLM Upper Snake Wildlife Biologist.
First light at Bosque del Apache National Wildlife Refuge in New Mexico. Established in November 22, 1939, the refuge has provided a critical stopover and wintering spot for thousands of sandhill cranes, geese and other waterfowl for 75 years. Bosque del Apache's sandhill crane population has multiplied from 18 birds in the 1840s to more than 20,000 birds today. Photo by Kim Hang Dessoliers (www.sharetheexperience.org).
Certification and Accreditation is required by the Federal Information Security Management Act (FISMA) of 2002. All systems and applications supporting Federal government agencies must go through a formal C&A before being put into production, and every three years thereafter. Certification is the comprehensive evaluation of the technical and non-technical security features of an information system and other safeguards, made in support of the accreditation process, to establish the extent to which a particular design and implementation meet a set of specified security requirements. Accreditation is a formal declaration by the Authorizing Official (AO) that an information system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk to the Agency.
OCIO provides Certification and Accreditation services through a proven engagement methodology that ensures customer readiness and efficient delivery, minimizing impact to your technology support teams.
OCIO's Information Systems Security Line of Business Center of Excellence (ISSLOB COE) performs the development, update and review of all required security documentation, provide C&A consultation services to the information system personnel, and performs an independent assessment on the information system to ensure all required system security controls are in place, implemented correctly and operating as intended. All services are implemented in accordance with the guidelines specified within NIST 800-37, Certification and Accreditation.
NIST 800-37 establishes a standard security certification and accreditation process to be used throughout the Federal Government. The NIST process is designed to be adaptable to any type of information system and any computing environment and mission within the government.
Our A&A Services
In the Initiation Phase, the certification agent (OCIO) analyzes the security documentation supporting the information system. The purpose of the initiation phase is to ensure that the Authorizing Official (AO) and the client's Chief Information Security Officer (CISO) are in agreement with the contents of the System Security Plan (SSP). In the Initiation Phase we review:
System Characterization Assessment
System Security Categorization Assessment
Privacy Impact Assessment
System Security Plan
Contingency/Disaster Recovery Plan
Security Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation. The purpose of our testing is to determine if the controls are implemented correct, operating as intended and producing the desired control described in the System Security Plan. Activities include:
Security Test and Evaluation Plan
Security Assessment Report
Plan of Action and Milestones
Security accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls. Activities include:
A&A Package Review
Authorization Package Submission
Customized C&A Services
OCIO offers customized C&A services to include:
System Development Lifecycle A&A Services Integration
Pre-Deployment Certification and Accreditation
In-flight Annual Reviews
CP/DR Test, Compliance Verification (Optional)
In addition to the basic C&A package, OCIO can provide assistance creating or updating the following:
A&A Documentation Preparation
Security Technical Guidelines
Security Awareness and Training Plan
Configuration Management Plan
Patch Management Plan
Rules of Behavior
Contingency/Disaster Recovery Plan
Incident Response Plan
Continuous Monitoring Plan
No separate contract is required. No sole source justification is required.
The OCIO ISSLOB COE is positioned to provide C&A services to DOI and federal government agencies. As an OMB designated ISSLOB, work is initiated through an Inter-Agency Agreement (IAA) with the Interior Business Center Line of Business.
The IAA will reference an agreed upon Memorandum of Understanding, with supporting Proposal, Statement of Work and Rules of Engagement documents. Authority Under Which C&A is Provided: Economy Act — 31 USC 1535 and Working Capital Fund, 43 USC 1467, 1468.