Navy C&A Process

1. Navy C&A Process Overview of Key Concepts Paul Hilton Navy Certifying AuthoritySPAWAR 5.0.9January 20, 2011

2. Agenda • Introduction • DoD Information Assurance Certification and Accreditation Process (DIACAP) • The Importance of Testing/Following the Process • Security Architecture and Engineering • Policy, Guidance, and Information Assurance (IA) Controls • Information System (IS) Documentation • Inheritance, Aggregation, Reciprocity, and Mitigation • Roles and Responsibilities • IS Security Engineer (ISSE) • Validator • Liaison • Certifying Authority (CA) • ODAA (Operational Designated Approving Authority)

3. Introduction • The Navy Certifying Authority • RADM Bachmann designation of GENSER Certifying Authority and Alternates Paul Hilton, Navy CA Keven Nelson, Alternate CA Amrik Khatra, Alternate CA

4. DIACAP

6. Following the Process = Faster Determination

7. Security Architecture and Engineering

8. Policy, Guidance, and IA Controls NIST Guidance NSA Guidance

9. IS Documentation

10. Inheritance, Aggregation, Reciprocity, and Mitigation

11. Roles and Responsibilities: ISSE

12. Roles and Responsibilities: Validator

13. Roles and Responsibilities: Liaison

14. Roles and Responsibilities: CA

15. Roles and Responsibilities: ODAA

16. Questions? NAVY_CA@navy.mil Toll-free phone number: (866) 966-2748

17. End of Presentation

18. Backups Stopping the wily hacker That one magic security setting Starting the DIACAP process too late