Certification & Accreditation Services

Certification and Accreditation is required by the Federal Information Security Management Act (FISMA) of 2002. All systems and applications supporting Federal government agencies must go through a formal C&A before being put into production, and every three years thereafter. Certification is the comprehensive evaluation of the technical and non-technical security features of an information system and other safeguards, made in support of the accreditation process, to establish the extent to which a particular design and implementation meet a set of specified security requirements. Accreditation is a formal declaration by the Authorizing Official (AO) that an information system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk to the Agency.

OCIO provides Certification and Accreditation services through a proven engagement methodology that ensures customer readiness and efficient delivery, minimizing impact to your technology support teams.

OCIO’s Information Systems Security Line of Business Center of Excellence (ISSLOB COE) performs the development, update and review of all required security documentation, provide C&A consultation services to the information system personnel, and performs an independent assessment on the information system to ensure all required system security controls are in place, implemented correctly and operating as intended. All services are implemented in accordance with the guidelines specified within NIST 800-37, Certification and Accreditation.

NIST 800-37 establishes a standard security certification and accreditation process to be used throughout the Federal Government. The NIST process is designed to be adaptable to any type of information system and any computing environment and mission within the government.

Our C&A Services

Initiation Phase

In the Initiation Phase, the certification agent (OCIO) analyzes the security documentation supporting the information system.  The purpose of the initiation phase is to ensure that the Authorizing Official (AO) and the client’s Chief Information Security Officer (CISO) are in agreement with the contents of the System Security Plan (SSP).  In the Initiation Phase we review:

  • System Characterization Assessment
  • System Security Categorization Assessment
  • Privacy Impact Assessment
  • System Security Plan
  • Contingency/Disaster Recovery Plan
  • Risk Assessment

Certification Phase

Security Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation.  The purpose of our testing is to determine if the controls are implemented correct, operating as intended and producing the desired control described in the System Security Plan.  Activities include:

  • System Test and Evaluation Plan
  • System Test and Evaluation
  • Security Assessment Report
  • Plan of Action and Milestones

Accreditation Phase

Security accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls.  Activities include:

  • C&A Package Review
  • CIO/CISO Briefing
  • Accreditation Package Submission
  • AO Briefing
  • Accreditation Decision

Customized C&A Services

OCIO offer customized C&A services to include:

  • System Development Lifecycle C&A Services Integration
  • Pre-Deployment Certification and Accreditation
  • System Recertification
  • In-flight Annual Reviews
  • CP/DR Test, Compliance Verification (Optional)

Optional Services

In addition to the basic C&A package, OCIO can provide assistance creating or updating the following:

  • C&A Documentation Preparation
  • Security Policies
  • Security Procedures
  • Security Technical Guidelines
  • Security Awareness and Training Plan
  • Configuration Management Plan
  • Patch Management Plan
  • Rules of Behavior
  • Contingency/Disaster Recovery Plan
  • Incident Response Plan

Rapid Engagement

No separate contract is required.
No sole source justification is required.

The OCIO ISSLOB COE is positioned to provide C&A services to DOI and federal government agencies.  As an OMB designated ISSLOB, work is initiated through an Inter-Agency Agreement (IAA) with the OCIO Line of Business. 

The IAA will reference an agreed upon Memorandum of Understanding, with supporting Proposal, Statement of Work and Rules of Engagement documents.   Authority Under Which C&A is Provided:  Economy Act – 31 USC 1535 and Working Capital Fund, 43 USC 1467, 1468.

For Additional Information:

Please contact the OCIO ISSLOB at ISSLOB@ios.doi.gov or 303-969-5700.