According to which of the following DoD policies, the implementation of DITSCAP is mandatory for all the systems that process both DoD classified and…

DoD Directive 8500.1, "Information Assurance (IA)," was the high-level, overarching policy document that established the comprehensive IA framework for the Department of Defense. This directive explicitly mandated that all DoD information systems must be certified and accredited. Specifically, it directed the use of the process defined in DoD Instruction 5200.40, which was the DITSCAP. Therefore, while DoDI 5200.40 detailed the process, DoD 8500.1 was the primary policy that mandated its implementation as a foundational element of the DoD's IA program.

A. DoD 8500.2: This document, "Information Assurance (IA) Implementation," provided detailed guidance for implementing IA controls and was subordinate to the policy set forth in DoD 8500.1.

B. DoDI 5200.40: This instruction established and defined the DITSCAP process. However, the question asks for the overarching policy that made it mandatory, which was the higher-level DoD 8500.1 directive.

C. DoD 8510.1-M DITSCAP: This is an invalid document reference. The DoD 8510 series (specifically DoDI 8510.01) pertains to the DoD Information Assurance Certification and Accreditation Process (DIACAP), which superseded DITSCAP.

---

1. U.S. Department of Defense. (2002

October 24). DoD Directive 8500.1: Information Assurance (IA). Section 4.3

"Policy

" states

"All DoD information systems shall be certified and accredited in accordance with DoD Instruction 5200.40

'DoD Information Technology Security Certification and Accreditation Process (DITSCAP)' (reference (e))

and the guidance in this Directive."

2. Rader

J. M. (2007). From DITSCAP to DIACAP: A Guide to the new Department of Defense Certification and Accreditation Process [Thesis

Naval Postgraduate School]. Calhoun: The NPS Institutional Archive. On page 10

the thesis states

"DoDD 8500.1 directed that all DoD information systems be certified and accredited in accordance with the DoD Information Technology Security Certification and Accreditation Process (DITSCAP)." (Available at: https://calhoun.nps.edu/handle/10945/3361)

3. U.S. Department of Defense. (1997

December 30). DoD Instruction 5200.40: DoD Information Technology Security Certification and Accreditation Process (DITSCAP). This document defines the process itself

with Section 4.1 stating

"The DITSCAP shall be implemented throughout the Department of Defense

" making it the foundational instruction referenced by the higher-level policy in DoD 8500.1.