2.10 The Use of Risk in the Authorization Decision (was: The Use of Risk in the Accreditation Decision)
All changes in this version
Title changed
Before · SP 800-79-1
The Use of Risk in the Accreditation Decision
After · SP 800-79-2
The Use of Risk in the AccreditationAuthorization Decision
Control changed
Before · SP 800-79-1
Accreditation is the official management decision by the DAA to authorize operation of a PCI, based on an assessment of its reliability and an acceptance of the risk inherent in that decision. By granting an authorization to operate, the DAA accepts responsibility for the reliability of the PCI and is fully accountable for any adverse impact to the organization or any other organization from cards issued by the PCI, its facilities, and any external service providers.
The assessment of a PCI provides the DAA with the basis for not only determining its reliability, but also for determining whether to accept the risk to the organization in granting an ATO. As the requirements in FIPS 201-1 and related documents form the basis of the assessment and are ultimately derived from the policy objectives of HSPD-12, those not reliably met by the PCI and its facilities represent the potential for adverse impact.
Implementation of an HSPD-12 program exposes an organization to specific risks at the mission level of the organization. The PIV Card is used to establish assurance of the identity of the cardholder, and as such, it must be trusted as a basis for granting access to the logical and physical resources of the organization. Any problem with an issued PIV Card that undermines that assurance could expose an organization to harm. Furthermore, the collection, processing, and dissemination of significant amounts of personal information required to issue a PIV Card increases the threat of this information being used for malicious purposes. It is the DAA’s responsibility to weigh the risks of these and other security and privacy impacts of issuing PIV Cards when making the accreditation decision.
Furthermore, as HSPD-12 is a government-wide mandate based on a standard of interoperability allowing organizations to accept other organizations’ PIV Cards, accreditation decisions within a single organization directly impact other organizations. For example, an interoperable identity credential issued by an accredited organization becomes the source of trust for another organization to authorize access to physical and logical resources, based on verification of that identity. The DAA’s signature on the accreditation letter thus signifies his/her acceptance of responsibility (i.e., accountability) for the operations of the PCI, not only to the issuing organization, but also to other organizations that are in the federated circle of trust.
After · SP 800-79-2
AccreditationAuthorization is the official management decision by the DAADAO to authorizepermit operation of aan PCI,issuer based on an assessment of its reliability and an acceptance of the risk inherent in that decision. By granting an authorization to operate, the DAADAO accepts responsibility for the reliability of the PCIissuer and is fully accountable for any adverse impact to the organization or any other organization from cards issued by the PCI,use itsof facilities,issued andPIV anyCard externalor serviceDerived providersPIV Credentials.
The assessment of aan PCIissuer provides the DAADAO with the basis for not only determining its reliability, but also for determining whether to accept the risk to the organization in granting an ATO. As the requirements in FIPS 201-1201-2 and related documents form the basis of the assessmentauthorization and are ultimately derived from the policy objectives of [HSPD-12] , those not reliably met by the PCIissuer and its issuing facilities represent the potential for adverse impact.
Implementation of an [HSPD-12] program exposes an organization to specific risks at the mission level of the organization. The PIV Card is used to establish assurance of thean identity of the cardholder, and as such, it must be trusted as a basis for granting access to the logical and physical resources of the organization. Similarly, the Derived PIV Credential is also used to establish the assurance of an identity, and must be trusted as a basis for granting access from mobile devices to the remote IT resources of the organization. Any problem with an issued PIV Card or Derived PIV Credential that undermines thatthis assurance could expose an organization to harm. Furthermore, the collection, processing, and dissemination of significant amounts of personal information is required to issue athese PIVcredentials Cardand thereby increases the threat of this information being used for malicious purposes 14 if not secured. It is the DAA’sDAO’s responsibility to weigh the risks of these and other security and privacy impacts of issuing PIV Cards when making the accreditationauthorization decision.HSPD-12[HSPD- 12] is a government-wide mandate based on a standard of interoperability allowing organizations to accept other organizations’ PIV Cardscredentials, accreditationauthorization decisions within a single organization
14 Note: Personally Identifiable Information (PII) collection is minimized for Derived PIV Credentials because of the derivation process. directly impact other organizations. For example, an interoperable identity credential issued by an accreditedauthorized organization becomes the source of trust for another organization to authorizegrant access to physical and logical resources, based on verification of that identity. The DAA’sDAO’s signature on the accreditationauthorization letter thus signifies his/her acceptance of responsibility (i.e., accountability) for the operations of the PCIissuer, not only to the issuing organization, but also to other organizations that are in the federated circle of trust.