What is an adequate list of mandatory security requirements based on Public Law and other regulation that Civilian agencies should use as a baseline for Certification & Accreditation (C&A)?
A. OMB Circular A-130 requires a management official authorize in writing the use of each general support system or major application based on the implementation of its security plan before beginning or significantly changing processing in the system. Use of the system shall be re-authorized at least every three years. NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems provides guidance on the certification and accreditation process.
Related Questions
- What is an adequate list of mandatory security requirements based on Public Law and other regulation that Civilian agencies should use as a baseline for Certification & Accreditation (C&A)?
- Can Knowledgeone K1 implement the mandatory OICT security requirements for NSW public agencies?
- What is Regulation SHO Threshold Security List?
