An official website of the United States government
          Here's how you know
        Here's how you knowDot gov**Official websites use .gov**
              
              A **.gov** website belongs to an official government organization in the United States.
        Https**Secure .gov websites use HTTPS**
              
              A **lock** (   Locked padlock
 ) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.  Newsroom
                                
                          
        
                Vote.gov Accessibility Menu
  

        
        Accessibility Menu
      Toggle Font Size
                                        
                                
          
                    Toggle OpenDyslexic
                                        
                                
          
                    Toggle Dyslexia-friendly black-on-creme color scheme
                                        
                                
          
                    Contact Us
 *U.S. Department of the Interior*
Menu


    close

        
        
                        
        
        
  
  
          About
      
                
        
        
  
  
          About
                    Interior
              
      
                
        
        
  
  
          Meet the Secretary
      
                        
                    
      
              Interior Leadership
      
                        
                    
      
              Departmental Offices
      
                        
                    
      
              History of the Interior
      
                        
                    
      
                      Join
              
      
                
        
        
  
  
          Careers
      
                        
                    
      
              Pathways Program
      
                        
                    
      
              Veterans Employment
      
                        
                    
      
              Volunteer
    
  

      
              
      
                        
                    
      
              Bureaus
      
                
        
        
  
  
          Bureaus
                    Bureaus
              
      
                
        
        
  
  
          Bureau of Indian Affairs
      
                        
                    
      
              Bureau of Indian Education
      
                        
                    
      
              Bureau of Land Management
      
                        
                    
      
              Bureau of Ocean Energy Management
      
                        
                    
      
              Bureau of Reclamation
      
                        
                    
      
              Bureau of Safety & Environmental Enforcement
      
                        
                    
      
              Bureau of Trust Funds Administration
      
                        
                    
      
              National Park Service
      
                        
                    
      
              Office of Surface Mining Reclamation & Enforcement
      
                        
                    
      
              U.S. Fish & Wildlife Service
      
                        
                    
      
              U.S. Geological Survey
    
  

      
              
      
                        
                    
      
              Priorities
      
                
        
        
  
  
          Priorities
                    Addressing the Drought Crisis
      
                        
                    
      
                      Advancing Environmental Justice
      
                        
                    
      
                      America the Beautiful
      
                        
                    
      
                      Clean Energy Future
      
                        
                    
      
                      Increasing Outdoor Access
      
                        
                    
      
                      Investing in America
      
                        
                    
      
                      Strengthening Indian Country
      
                        
                    
      
                      Tackling the Climate Crisis
    
  

      
              
      
                        
                    
      
              Media
      
                
        
        
  
  
          Media
                    Blog
      
                        
                    
      
                      Press Releases
      
                        
                    
      
                      Media Contacts
      
                        
                    
      
                      Multimedia
    
  

      
              
      
    
          
    
  



Search

  Search


          
          
                      Newsroom
                                
                          
        
                Vote.govAccessibility Menu
  

        
        Accessibility Menu
      Toggle Font Size
                                        
                                
          
                    Toggle OpenDyslexic
                                        
                                
          
                    Toggle Dyslexia-friendly black-on-creme color scheme
                                        
                                
          
                    Contact Us
  


Breadcrumb
        Home
                            Office of the Chief Information Officer
                            Our Services
                            DOI Security Assessment & Authorization


  In This Section
    
      
      Home
                              About Us
                            OCIO Leadership
                              Our Services
                            Federation Services (SAML/OAuth)
                              Assessment and Authorization (A&A)
                              Customer Support Center
                              DOI Cloud Services
                              Hosting Services
                              Penetration Testing
                              Telecommunications
                              Policy & Mgmt
                            Controlled Unclassified Information (CUI) Program
                              Digital Strategy Report
                              E-GOV Program
                              Enterprise Architecture
                              Government Paperwork Elimination Act
                              Information Management and Assurance
                              Information Quality
                              Paperwork Reduction Act
                              Portfolio Management
                              Privacy
                              Records Management
                              Section 508 (Accessibility)
                              Support
                            Customer Support Center (CSC)
                              Paperwork Reduction Act Support
                              Privacy Support
                              Records Management Support
                              Section 508 Support
                              Controlled Unclassified Information Coordinators
                  
                  Share
  FacebookTwitterLinkedInRedditPinterest

  DOI Security Assessment & Authorization

Federal Information Security Modernization Act (FISMA) of 2014 requires federal agencies to develop, document, and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other sources.
In support of this requirement, all systems and applications supporting Federal government agencies must follow National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) Special Publication (SP) 800-37 as the standard for Assessment and Authorization (A&A) process before being put into production, and every five years thereafter.

The A&A process is a comprehensive assessment and/or evaluation of an information system policies, technical / non-technical security components, documentation, supplemental safeguards, policies, and vulnerabilities. The A&A process establishes the extent to which a particular design and implementation, meet a set of specified security requirements defined by the organization, government guidelines, and federal mandates into a formal authorization package. This authorization package is reviewed by the Authorizing Official (AO) and a formal declaration of an information system accreditation is either granted as an Authorization to Operate (ATO) or ATO with conditions or outright denial of authorization to operate. Given the ATO the information system is to operate in a particular security mode using a prescribed set of safeguards and function at an acceptable level of risk to the agency.  Each information system is placed into the Information Security Continuous Monitoring (ISCM) (NIST SP 800-137) program which maintains the ongoing awareness of information security, vulnerabilities, and threats to an information system.

DOI Office of the Chief Information Officer (OCIO) provides A&A accreditation services through a proven methodology that ensures customer readiness and efficient delivery, minimizing impact to your technology support teams.

OCIO's Information Systems Security Line of Business Center of Excellence (ISSLOB COE) performs the development, update and review of all required security documentation, provide A&A consultation services to the information system personnel, and performs an independent assessment on the information system to ensure all required system security controls are in place, implemented correctly and operating as intended.
**Our A&A Services**
**Initiation Phase**
In the Initiation Phase, the policy analyst (OCIO) analyzes the security documentation supporting the information system. The purpose of the initiation phase is to ensure that the Authorizing Official (AO) and the client's Chief Information Security Officer (CISO) are in agreement with the contents of the System Security Plan (SSP). In the Initiation Phase we review or update the following documentation:
System Security Categorization Federal Information Processing Standards (FIPS) 199
Privacy Impact Assessment
System Security Plan
Contingency/Disaster Recovery (CP/DR) Plan
Risk Assessment
**Assessment Phase**
The assessment is a comprehensive analysis of the management, operational, and technical security controls in an information system, made in support of A&A. The purpose of our assessment is to determine if the controls are implemented correctly, operating as intended and producing the desired control described in the System Security Plan. Activities include:Security Test and Evaluation Plan
Security Assessment Report
Plan of Action and Milestones
**Authorization Phase**
ATO is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls. Activities include:
A&A Package Review
AO Briefing
Authorization Package Submission
Authorization Decision**Customized A&A Services**
OCIO offers customized A&A services to include:
System Development Lifecycle A&A Services Integration
Pre-Deployment Certification and Accreditation
System Reauthorization
In-flight Annual Reviews
CP/DR Test, Compliance Verification (Optional)**Optional Services**
In addition to the basic A&A package, OCIO can provide assistance creating or updating the following:
A&A Documentation Preparation
Security Policies
Security Procedures
Security Technical Guidelines
Security Awareness and Training Plan
Configuration Management Plan
Patch Management Plan
Rules of Behavior
Contingency/Disaster Recovery Plan
Incident Response Plan
Continuous Monitoring Plan**Rapid Engagement**
***No separate contract is required.No sole source justification is required.***
The OCIO ISSLOB COE is positioned to provide A&A services to DOI and federal government agencies. As an OMB designated ISSLOB, work is initiated through an Inter-Agency Agreement (IAA) with the Interior Business Center Line of Business.
The IAA will reference an agreed upon Memorandum of Understanding, with supporting Proposal, Statement of Work and Rules of Engagement documents. Authority Under Which A&A is Provided: Economy Act — 31 USC 1535 and Working Capital Fund, 43 USC 1467, 1468.
**For Additional Information:**
Contact OCIO ISSLOB
Phone: 303-969-5700
Was this page helpful?
    
      Yes
No
This page was not helpful because the content:
          

        
  
      Please provide a comment


  
Leave this field blankReturn to top
    
          Subscribe
    
      Enter your email address to subscribe to Interior news and updates


  Leave this field blank
Section Title
  

        
      About DOI
                              Accessibility
                              Contact Us
                              Copyright
                              Disclaimer
                              Information Quality
                              Privacy Policy
                              Site Map
                              Vulnerability Disclosure PolicySection Title
  

        
      Budget & Performance
                              Coronavirus Updates
                              Cummings Act Notices
                              Diversity, Inclusion & Civil Rights
                              FOIA
                              Inspector General
                              No Fear Act reports
                              Open Government Initiative
    
          U.S. Department of the Interior
                    Stewarding Conservation and Powering Our Future

                          1849 C Street NW, Washington, DC 20240