DIARMF A&A – Assessment Authorization

Defense Information Assurance Risk Management Framework Assessment & Authorization is similar to what certification and accreditation (C&A).

With DIACAP transition comes some new terms but essentially the same kinds of work.  Risk management framework still does the comprehensive evaluation of security features but calls it assessment instead of ceritification.  Where DIACAP had the Designating Authorizing Authority (DAA) to formally accredit a system, DIARMF has an Authorizing Official (AO) to authorize a system.  

So essentially, the terms “C&A” certification and accreditation is superseded by “A&A” assessment and authorization.  Another term that has changed with the transition from DIACAP to DIARMF is “information assurance (IA) controls” which is now called “security controls”.  The security controls mark one of the biggest differences between DIACAP and DIARMF since there are so many more security controls in NIST SP 800-53 than there are in DIACAP’s DOD 8500.2.

Certification (NIST Assessment) – Comprehensive evaluation of an information system assessment of IA Controls/Security Controls to determine the extent to which the controls are implemented correctly and operating as intended. That means when evaluated, they produce the desired outcome.  An assessment is about gathering information to providing the factual basis for an authorizing official (Designated Accrediting Authority) to render a security accreditation decision

Accreditation (NIST Authorization) – Security accreditation is the official management decision to operate (DAA – Formal approval of the system). Authorization is given by a senior agency official (upper-management/higher head quarters/combat commander). The official should have the authority to oversee the budget and business operations of the information system explicitly accept the risk to operations, assets, individuals. They accept responsibility for the security of the system and are fully accountable for the security of the system.

“The official management decision given by a senior organization“The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls.” – NIST SP 800-37 rev 1