System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System…

The System Authorization process, historically known as Certification and Accreditation (C&A), is a formal risk management lifecycle. The process is structured into four primary phases. It begins with Pre-certification (E), which involves planning, system definition, and control selection. This is followed by the Certification (A) phase, a comprehensive technical and non-technical evaluation of the system's security controls. Based on the certification results, a senior official makes the formal Authorization (B) decision to accept the risk and permit the system to operate. Finally, the Post-Authorization (D) phase consists of continuous monitoring and maintaining the system's security posture throughout its operational lifecycle.

C. Post-certification: This is not a standard, distinct phase in the System Authorization lifecycle. Activities that occur after the certification evaluation are integral parts of the subsequent Authorization and Post-Authorization phases.

1. National Institute of Standards and Technology (NIST) Special Publication 800-37

Revision 1

Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

February 2010. The RMF steps described in this foundational document map directly to the C&A phases:

Steps 1-3 (Categorize

Select

Implement) represent Pre-certification activities.

Step 4 (Assess) is the Certification phase (Section 3.5

page 39).

Step 5 (Authorize) is the Authorization phase (Section 3.6

page 45).

Step 6 (Monitor) is the Post-Authorization phase (Section 3.7

page 48).

2. Department of Defense (DoD) Instruction 8510.01

DoD Information Assurance Certification and Accreditation Process (DIACAP)

November 28

2007. Although superseded

this instruction is a key historical document for the ISSEP domain and explicitly defines the lifecycle. Enclosure 3

Figure 1 outlines the four phases that directly correspond to Pre-certification (Phase 1)

Certification (Phase 2)

Authorization (Phase 3)

and Post-Authorization (Phase 4).

3. Wilson

M.

& Hash

J. (2003). NIST Special Publication 800-60

Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories. This guide is used in the initial Pre-certification phase to categorize systems

which is a prerequisite for the subsequent certification and authorization activities (see Section 3

"The Categorization Process").