Web Commerce Security Design and Development

Certification and Accreditation

The National Information Assurance Glossary¹, defines certification as a “comprehensive evaluation of the technical and nontechnical security safeguards of an information system (IS) to support the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements.” It defines accreditation as a “formal declaration by a Designated Accrediting Authority (DAA) that an information system is approved to operate in a particular security mode at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural safeguards.” The C&A process is implemented differently depending on the organization, with the common theme of ensuring that the information systems meet identified security standards. C&A is a formal process that comprises a number of well-defined steps as developed in the following sections.

System authorization is the process of assessing risk associated with a system, and, when necessary, taking steps to mitigate vulnerabilities to reduce risk to an acceptable level. Risk management is the total process of identifying, controlling, and mitigating IT system–related risks.

The Certification Process

The goal of the certification is to determine how well the information system security controls are implemented, if they are operating as intended, and if the controls are meeting the security requirements for the system. ...