# Presentation: 702289

## NVLAP Overview

**NVLAP Overview**
**and**
**Accreditation Process**

**March 2006**

- <date/time>

**National Voluntary Laboratory Accreditation Program**

## Jeffrey Horlick, Guest Researcher
National Institute of Standards and Technology
National Voluntary Laboratory Accreditation Program
(NIST / NVLAP)
Building 820 Room 287
100 Bureau Drive Stop 2140
Gaithersburg, MD 20899-2140

Phone: 301.975.4020
Fax: 301.926.2884
E-mail: jeffrey.horlick@nist.gov
URL: http://www.nist.gov/nvlap

- <date/time>

**Jeffrey **_**Horlick**_**, Guest Researcher**
**National Institute of Standards and Technology**
**National Voluntary Laboratory Accreditation Program**
**(NIST / NVLAP)**
**Building 820 Room 287**
**100 Bureau Drive Stop 2140**
**Gaithersburg, MD 20899-2140**
**Phone: 301.975.4020**
**Fax: 301.926.2884**
**E-mail: jeffrey.horlick@nist.gov**
**URL: http://www.nist.gov/nvlap**

## Why Laboratory Accreditation?

- So you don’t have to worry.
- Confidence - it has been done right
- Competence - get the right answer
- Equivalence - get the same answer
- Independence - nothing else is going on
- Appropriateness - fit for purpose
- Repeatability - get the same answer twice
- Reproducibility - others get same answer

## Why Harmonized Standards?

- So you can talk to each other
- So you can do business with each other

## Paths to Consumer

**Supplier**

**Consumers**

**Consumers**

**3**

**2**

**1**

**3**

**Accredited**
**Testing Labs**

**2**

**Product**
**Certification Bodies**

**3**

**3**

**Path 1:  Declaration of Conformity**
**Path 2:  Conformance demonstrated by testing in accredited laboratory**
**Path 3:  Conformance demonstrated by testing and product certification**

**NVLAP**

**Consumers**

**Certified**
**Products**
**Lists**

## Slide 7

## NVLAP Programs (LAPS) for Information Technology Security Testing

- NVLAP accredits laboratories for testing to:
- Federal Information Processing Standard (FIPS) 140-2 for cryptographic modules
-  details:	http://www.nist.gov/cmvp
- ISO/IEC 15408 Common Criteria
-   details:	http://niap.nist.gov/cc-scheme/  and
- 	            http://niap.nist.gov/index.html

## NVLAP Programs (LAPS) for Information Technology Security Testing

-  NVLAP is adding a program for NPIVP
- 	details:  http://www.nist.gov/npivp
** **for the Scope of PIV Card Application and Middleware Interface Testing per FIPS 201

## Program Specific Requirements for the NPIVP LAP

- NIST Handbook 150 *NVLAP Procedures and General Requirements* (contains ISO/IEC 17025) - 2006 revision coming soon
- All requirements of the NPIVP
- NIST Handbook 150-xx for NPVIP which extends and defines Handbook 150 specifically for this program
- Proficiency Testing is designed specifically for this program
- Technical experts are trained in the NVLAP methodology and to assess to ISO/IEC 17025

## Accreditation to ISO/IEC 17025

- Review of quality system: Quality Manual, Procedures, Instructions, Records
- On-site assessment by a team of peer technical experts
- Participation in proficiency testing
- Evaluation of the above by NVLAP team
- Feedback to the laboratory
- Corrective action by the laboratory

## Proficiency Testing

- An integral part of the accreditation process - customized for field
- A means of periodically checking laboratory performance and ability
- Required for initial and/or continuing accreditation

## ISO 17025 - Management Requirements (Section 4 of NIST Handbook 150)

- Organization
- Quality system
- Document control
- Review of requests, tenders and contracts
- Subcontracting of tests and calibrations
- Purchasing services and supplies
- Service to the client
- Complaints

## ISO 17025 - Management Requirements  		      cont’d 

- Control of nonconforming testing and/or calibration work
- Corrective action
- Preventive action
- Control of records
- Internal audits
- Management reviews

## ISO/IEC 17025 -Technical Requirements (Section 5 of NIST Handbook 150)

- General - factor contributing to correctness and reliability
- Personnel
- Accommodation and environmental conditions
- Test and calibration methods and method validation
- Equipment

## ISO/IEC 17025 -Technical Requirements 			    cont’d

- Measurement traceability
- Sampling
- Handling of test and calibration items
- Assuring the quality of test and calibration results
- Reporting the results

## Additional NVLAP requirements

- Referencing NVLAP accreditation (use of logo and “NVLAP”)
- Implementation of traceability policy
- Approved Signatory
- Authorized Representative(s)

## Applicants for Accreditation

- Send application to NVLAP including:
- General Application Forms
- Program Specific Application Form
- Fees
- Quality Manual
- Quality documentation review by assessors
- Proficiency testing of artifact
- On-site Assessment with Round Table Quiz
- Resolution of all non-conformances
- NVLAP review and grant of accreditation

## NVLAP Application Fees

- Administration/Technical Support Fee $4190
- Discount of $2600 for labs in ITST LAPs
- 1st-time laboratory fee $500
- Proficiency Testing $0 at this time
- On-site Assessment Fee $5040
- Total for 1st time laboratory $9730
- Total lab adding NPIVP $6630
- See NVLAP web site for General Application and description of fee structure

## Typical On-site Visit - conducted every other year (after initial two)

- Team of two assessors for 1 1/2 days
- Entry meeting with lab management
- Review quality system documentation including, records, personnel folders, technical documentation, internal audits, management reviews
- Examine facilities, hardware, software,..
- Staff interviews on all aspects of standards and testing with appropriate demonstrations

## Typical On-site Visit - conducted every other year - cont’d

- Proficiency testing
- Exit meeting
- On-Site Assessment Report given to lab
- Required written responses to NVLAP are discussed

## Quality System documentation includes (but is not limited to)

- Quality manual
- Policies, objectives, commitments
- Procedures - management and technical
- Instructions - management and technical
- Records - management and technical
- Roles and responsibilities
- Organization charts - inside laboratory boundary and laboratory's place in larger organization
- Complaints log

## Proficiency Testing

- Before the on-site visit
- Conduct of a test using the NIST-provided test tool and NIST provided artifact(s)
- Test report reviewed
- Feedback to laboratory

## Granting Accreditation

- NVLAP reviews all information with input from assessor team
- All non-compliances must be resolved
- NVLAP grants accreditation for one year
- Renewal each year with on-site every-other year (after initial and first-year onsite assessments)