Certification & Accreditation Services

ISSLOB Home | C&A Services | Penetration Testing

Servers Certification and Accreditation is required by the Federal Information Security Management Act (FISMA) of 2002. All systems and applications supporting Federal government agencies must go through a formal C&A before being put into production, and every three years thereafter. Certification is the comprehensive evaluation of the technical and non-technical security features of an information system and other safeguards, made in support of the accreditation process, to establish the extent to which a particular design and implementation meet a set of specified security requirements. Accreditation is a formal declaration by the Authorizing Official (AO) that an information system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk to the Agency.

NBC provides Certification and Accreditation services through a proven engagement methodology that ensures customer readiness and efficient delivery, minimizing impact to your technology support teams.

NBC’s Information Systems Security Line of Business Center of Excellence (ISSLOB COE) performs the development, update and review of all required security documentation, provide C&A consultation services to the information system personnel, and performs an independent assessment on the information system to ensure all required system security controls are in place, implemented correctly and operating as intended. All services are implemented in accordance with the guidelines specified within NIST 800-37, Certification and Accreditation.

NIST 800-37 establishes a standard security certification and accreditation process to be used throughout the Federal Government. The NIST process is designed to be adaptable to any type of information system and any computing environment and mission within the government.

Our C&A Services

Initiation Phase

In the Initiation Phase, the certification agent (NBC) analyzes the security documentation supporting the information system. The purpose of the initiation phase is to ensure that the Authorizing Official (AO) and the client’s Chief Information Security Officer (CISO) are in agreement with the contents of the System Security Plan (SSP). In the Initiation Phase we review:

System Characterization Assessment
System Security Categorization Assessment
Privacy Impact Assessment
System Security Plan
Contingency/Disaster Recovery Plan
Risk Assessment

Certification Phase

Security Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation. The purpose of our testing is to determine if the controls are implemented correct, operating as intended and producing the desired control described in the System Security Plan. Activities include:

System Test and Evaluation Plan
System Test and Evaluation
Security Assessment Report
Plan of Action and Milestones

Accreditation Phase

Security accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls. Activities include:

C&A Package Review
CIO/CISO Briefing
Accreditation Package Submission
AO Briefing
Accreditation Decision

Customized C&A Services

NBC offer customized C&A services to include:

System Development Lifecycle C&A Services Integration
Pre-Deployment Certification and Accreditation
System Recertification
In-flight Annual Reviews
CP/DR Test, Compliance Verification (Optional)

Optional Services

In addition to the basic C&A package, NBC can provide assistance creating or updating the following:

C&A Documentation Preparation
Security Policies
Security Procedures
Security Technical Guidelines
Security Awareness and Training Plan
Configuration Management Plan
Patch Management Plan
Rules of Behavior
Contingency/Disaster Recovery Plan
Incident Response Plan

Rapid Engagement

No separate contract is required.
No sole source justification is required.

The NBC ISSLOB COE is positioned to provide C&A services to DOI and federal government agencies. As an OMB designated ISSLOB, work is initiated through an Inter-Agency Agreement (IAA) with the National Business Center Line of Business.

The IAA will reference an agreed upon Memorandum of Understanding, with supporting Proposal, Statement of Work and Rules of Engagement documents. Authority Under Which C&A is Provided: Economy Act – 31 USC 1535 and Working Capital Fund, 43 USC 1467, 1468.

For Additional Information:

Please contact the NBC ISSLOB at ISSLOB@nbc.gov or 303-969-5700.