PRISM Certification and Accreditation

Does your organization have a comprehensive program that ensures the implementation of PRISM controls for systems and applications prior to implementation? If so - great! If not - we can help.

The Certification and Accreditation process is commonly referred to as "C&A". Federal agencies in the United States must have their IT systems and infrastructure certified and accredited prior to the introduction of "live" or production data. Existing systems must follow the C&A process during the next applicable modification or upgrade.

Background and Purpose

Although mandated for Federal agencies, the C&A process (or reasonable substitute) is also useful for private and publicly-held companies to ensure the security and sustainability of systems and applications.

The Federal Information Security Management Act (FISMA) requires the development and implementation of an information security program to safeguard information assets, including data. FISMA is specific in its requirements and stipulates that the information security program must include documentation and reports that clearly describe the following:

• Periodic risk assessment
• Information security policies, standards and procedures
• An assessment of threats, including their likelihood and impact
• Policies, standards and procedures for detecting security vulnerabilities
• Evaluation and periodic testing of how well security policies are working
• An inventory of hardware and software assets
• Security awareness training and expected rules of behavior for end users
• An evaluation of technical, management and operational security controls
• Procedures for reporting and responding to security incidents
• A process for addressing any and all deficiency reports
• Contingency plans to ensure continuity of operations in the face of disaster