NIST releases draft revision of guidelines for authorizing operation IT systems
Connecting state and local government leaders
Publication is part of an interagency project to harmonize C&A process across civilian, military and intelligence communities.
The National Institute of Standards and Technology has released for comment a draft document that caps an interagency project to standardize across government the certifying and accrediting processes for information technology systems.
NIST calls revision 1 of its Special Publication 800-37, Guide for Security Authorization of Federal Information Systems: A Security Life Cycle Approach, historic.
'For the past two years, NIST has been working in partnership with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DOD) and Committee on National Security Systems (CNSS) to develop a common information security framework for the federal government and its support contractors,' NIST said in introducing the document. 'The project, designated as the Certification and Accreditation (C&A) Transformation Initiative, is on target to produce a series of new CNSS policies and instructions that address risk management, security categorization, security control specification, security control assessment, and security authorization and that closely parallel the NIST security standards and guidelines developed during the past five years in response to Congressional legislation known as the Federal Information Security Management Act (FISMA).'
NIST is charged with developing standards and specifications for compliance with FISMA, which sets out requirements for managing the security of government information systems outside of the national security community. DOD and the intelligence agencies have developed their own standards and processes for national security systems. A single government-wide approach to managing IT security could make it easier for agencies to share data and cooperate with each other and with states, foreign allies and the private sector. It could enable reciprocity, the acceptance of other agencies' C&A processes without requiring recertification, and also could streamline acquisition processes and make it easier for vendors and developers to meet a single set of standards.
'We are very close to producing a unified C&A process for the entire federal government,' Ron Ross, a senior computer scientist and FISMA implementation lead at NIST, said recently. 'Within the next six to eight months you are going to see a plethora of new things coming out' from CNSS and NIST.
CNSS is working in parallel with NIST in developing policies for the national security community. As CNSS publishes its instructions, they will be incorporated into NIST guidelines in its 800 series of special publications. SP 800-37 is the first of these. Ross said a major update of SP 800-53 Rev. 2, Recommended Security Controls for Federal Information Systems, is expected to be released in December.
'The ultimate objective is to be able to provide the right information to senior leaders so they can explicitly manage the security risks to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations and the Nation arising from the operation and use of information systems,' NIST said.
Certification and accreditation is a process for ensuring that IT systems are operating with an appropriate level of security. The security of the system is first documented, which is the certification portion; then a designated authority signs off on its fitness to go into operation, the accreditation. The concept has been around for quite a while but there has been little standardization. The new version of SP 800-37 refers to 'security authorization' rather than to 'certification and accreditation.'
The goals of revising 800-37 are:
- Develop a common security authorization process for federal information systems (currently known as the C&A process).
- Make the process of authorizing information systems to operate an integral part of the System Development Life Cycle and the Risk Management Framework.
- Provide a well-defined and comprehensive security authorization process that helps ensure appropriate entities are assigned responsibility and are accountable for managing information system-related security risks.
- Incorporate a risk executive function into the security authorization process to help ensure that managing security risks from individual information systems is consistent across the organization, reflects organizational risk tolerance, and is part of an organization-wide process that considers other organizational risks affecting mission/business success.
NEXT STORY: Layer 3 support for PDAs