## Sample Generic Policy and High Level Procedures[^1] for Certification/Accreditation

### 

**Issue Statement**

#### 

#### XX Agency Director, Federal Systems must certify that the Large Security Application (LSA) has the appropriate safeguards in place and the data processed is secure. The requirement to certify and accredit a system to process data is contained in the LSA Automated Information Systems Security Program Handbook. The requirement is also contained in the Office of Management and Budget Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources. Certification and accreditation provides a form of quality control, it forces managers and technical staff to find the best fit for security, given technical constraints, operational constraints, and mission requirements. By certifying and accrediting a system, a manager accepts the risk associated with it. 

######## 

######## **Organization's Position**

XX Agency requires all systems that access LSA data to be certified and
accredited. For new application systems, the certification process must
begin during the design and development stage. The LSA system must be
recertified at least once every three years or if the systems undergo a
significant modification or is violated. The Director, Federal Systems
must complete three copies of the attached form, "Application System
Security Certification/Accreditation" a copy of the form should be
attached to the LSA security plan. If the LSA system does not meet the
security requirements, the system should not be accredited. In such
cases, the Director, Federal Systems must complete the attached form,
"Deferral of Certification/Accreditation." When a Deferral of
Certification/Accreditation statement is executed, the Director must
report the security weakness under the OMB Circular A-123, "Internal
Control Systems" reporting process.

#### Applicability

######### 

######### XX Agency requires all XX Agency organizations to certify and accredit sensitive systems. These procedures apply to the LSA System.

#### 

#### Roles and Responsibility 

######### 

[Director, Federal Systems]{.underline} shall:

-   publish and maintain policy guidelines for authorizing systems to
    process LSA data,

-   be the authorizing official for the LSA system,

-   complete three copies of the attached form, "Application System
    Security Certification/Accreditation" and forward one copy to the
    ISSO if the LSA system does not meet the security requirements,
    complete three copies of the attached form, "Deferral of
    Certification/Accreditation," and list the deficiencies that must be
    remedied, and

```{=html}
<!-- -->
```
-   when a Deferral of Certification/Accreditation statement is
    executed, report the security weakness under the OMB Circular A-123,
    "Internal Control Systems" reporting process.

[Information Systems Security Officer (ISSO)]{.underline} shall:

-   prepare policy guidelines for authorizing systems to process LSA
    data.

-   ensure all systems that process LSA data have completed the attached
    form, "Application System Security Certification/Accreditation"

-   if any system that processes LSA data does not meet the security
    requirements, complete three copies of the attached form, "Deferral
    of Certification/Accreditation," and list the deficiencies that must
    be remedied within the calendar year,

-   ensure a re-authorization is obtained every three years or when a
    system is significantly modified,

-   review and certify that LSA security controls are adequate, prepare
    the form, "Application System Security Certification/Accreditation"
    for the Director, Federal Systems signature,

-   attach signed Form in the LSA Security Plan, and

[Supervisors]{.underline} shall:

-   review and certify, at least every three years, that the system that
    accesses LSA data contains adequate security controls, and

-   mitigate any deficiencies contained in the Deferral of
    Certification/Accreditation Form within the next calendar year.

#### Rules for Authorizing/Accrediting a System

#### 

#### Based on the XX Agency Security Handbook, below are the minimum security controls that must be in place prior to authorizing a system for processing:

-   security plan developed, updated, and reviewed,

-   technical and/or security evaluation complete,

-   risk assessment conducted,

-   LSA security rules provided to users and signed by users,

-   contingency plan developed and tested,

-   system meets all applicable federal laws, regulations, policies,
    guidelines, and standards,

-   security specifications and test results,

-   in-place and planned security safeguards appear to be adequate and
    appropriate, and

-   in-place safeguards are operating as intended.

####  

#### Compliance

The requirement to certify, accredit or authorize a system to process
are contained in the XX Agency Automated Information Systems Security
Program Handbook and in the Office of Management and Budget Circular
A-130, "Management of Federal Information Resources, Appendix III,
Security of Federal Automated Information Resources".

#### Supplementary Information

-   XX Agency Automated Information Systems Security Program Handbook.
    May 1994

-   Office of Management and Budget Circular A-130, "Management of
    Federal Information Resources, Appendix III, Security of Federal
    Automated Information Resources." 1996

-   OMB Circular A-123, "Internal Control Systems." August 4, 1986

    **Points of Contact**

Information Systems Security Officer

LSA Security Officer -- XX Agency Site

**Application System Security Certification/Accreditation**

I have carefully reviewed the attached computer system security plan
together with the findings and recommendations of a documented risk
assessment; analysis of threats, vulnerabilities, and safeguards; or
security evaluation performed within the past three years. Based on my
authority and judgement, and weighing the residual risks against
operational requirements, I authorize continued operations of

\_\_\_\_\_\_\_*[name of
application]{.underline}*\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
under the following restrictions:

*(list restrictions, if any)*

I further authorize initiation of the following corrective actions, to
be completed within the next calendar year:

*(list corrective actions)*

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Director, Federal Systems (date)

**Deferral of Certification/Accreditation**

Based on a review of the attached computer system security plan,
requirements set forth in OMB Circular A-130, and the security
requirements of the LSA, this application cannot be accredited at this
time. The reasons for deferring such accreditation include:

\[ \] An analysis of threats, vulnerabilities, and safeguards has not
been performed within the last three years.

\[ \] No documented security specifications exist.

\[ \] Documented testing of security specifications has not been
performed within the last three years.

\[ \] Major vulnerabilities exist (specify).

\[ \] Personnel screening has not been performed.

\[ \] Security awareness training has not been performed.

\[ \] Other (specify).

I authorize initiation of the following correction actions, to be
completed within the next calendar year:

(*list corrective actions*)

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Director, Federal Systems (date)

[^1]: This document was written for a large application it can be
    modified to service as a chapter in an organization's information
    security manual by replacing any reference to one application with
    the words "all systems."