Does NSTISSP #11 validation of products replace system certification testing?
No. For national security systems, composite system level certification analysis and testing is still required per the local Designated Accrediting Authority requirements (e.g., DITSCAP, NIACAP). The hope is that using validated products will aid in increasing security of systems in development by allowing organizations to make more informed security decisions before procurement, and decrease the effort required for composite system testing before Accreditation.
