2.11 Authorization Submission Package and Supporting Documentation (was: Accreditation Submission Package and Supporting Documentation)
All changes in this version
Title changed
Before · SP 800-79-1
Accreditation Submission Package and Supporting Documentation
After · SP 800-79-2
AccreditationAuthorization Submission Package and Supporting Documentation
Control changed
Before · SP 800-79-1
The accreditation submission package documents the results of the assessment phase and provides the DAA with the essential information needed to make a credible, risk-based decision on whether to authorize operation of the PCI. Unless specifically designated otherwise by the DAA, the OIMO is responsible for the assembly, compilation, and submission of the accreditation package. The accreditation package contains the following documents:
• The PCI operations plan (including all PCI Facilities Standard Operating Procedures [SOPs] and attachments)
• SP 800-37 accreditation letters
• The assessment report
• The corrective actions plan (if required)
The PCI operations plan contains the PCI’s policies, procedures, and processes for all the major PCI functional areas. The operations plan provides a complete picture of the structure, management, and operations of the PCI to the Assessor and DAA. Appendix D provides a template of what to include in the PCI operations plan. One of the most significant pieces of information contained within the operations plan is the list of PCI controls, how they were implemented, and who is responsible for their management. This description of the PCI controls makes it a simple process for the Assessor to quickly ascertain how they were implemented and by whom.
If certain functions described in the operations plan are outsourced, the PCI’s operation plan can reference or “point to” the external service provider’s operation plan and related documentation, such as support agreements and any contracts. In this manner, the Assessor has access to the information regarding the external service provider’s operations without requiring the PCI to duplicate any documentation.
The SP 800-37 accreditation letters are the formal authorization to operate the PCI information systems that are directly involved in the issuance and maintenance of PIV Cards.
The PCI assessment report, prepared by the Assessor, provides the information needed to determine the extent to which the requirements are being met and are expected to continue as such during future operations. For each deficiency that is found, the assessment report must include the potential impact of the deficiency if it continues without correction and the recommended corrective action to correct it. Appendix E provides a template of what to include in the assessment report.
The corrective actions plan (CAP), prepared by the OIMO with the assistance of the Assessor, describes the changes needed to correct deficiencies noted during the assessment with a time frame for completing each change.
The OIMO submits the accreditation submission package to the DAA. 2 Figure 3 illustrates the primary components of the accreditation submission package.
2 Accreditation packages may be submitted in either paper or electronic format. Appropriate measures should be employed to protect the information contained in accreditation packages (electronic or paper format) in accordance with organization policy. DAA − Description of the PCI’s services, plans, procedures, technical specifications, supported options, and relevant documents (e.g., policies, standard operating procedures).
− Report of the PCI control assessments and recommended corrective actions for a PCI.
− Actions to be implemented by a PCI to remove or reduce deficiencies and risks.
− An authorization to operate for each and every information system within the PCI. PCI’S OPERATIONS PLAN
PCI’S ASSESSMENT REPORT
PCI’S CORRECTIVE ACTIONS PLAN (CAP)
SP 800-37 ACCREDITATION LETTERS
Figure 3 - Accreditation Submission Package
Upon receiving and reviewing the accreditation package and in consultation with the Assessor, the DAA decides whether to authorize operations of the PCI. The accreditation decision letter transmits the accreditation decision from the DAA to the OIMO. The accreditation decision letter contains the following information:
• Accreditation decision;
• Supporting rationale for the decision; and
• Terms and conditions for the authorization, including which PCIFs are included.
The accreditation decision letter (see Appendix F for examples) informs the OIMO that the PCI is— (i) authorized to operate; (ii) authorized to operate on an interim basis; or (iii) not authorized to operate. The supporting rationale includes the justification for the DAA’s decision. The terms and conditions for the authorization provide a description of any limitations or restrictions placed on the operation of the PCI, including which PCIFs are included in the decision. The accreditation decision letter is attached to the original accreditation submission package and becomes the accreditation decision package.
The DAA sends the accreditation decision package to the OIMO and retains a copy of it. The OIMO carefully reviews the terms and conditions of authorization before initiating the necessary steps for PCI operations. Both parties mark the accreditation decision package appropriately for storage under the organization’s retention policy.
After · SP 800-79-2
The accreditationauthorization submission package documents the results of the assessment phase and provides the DAADAO with the essential information needed to make a credible, risk-based decision on whether to authorize operation of the PCIissuer. Unless specifically designated otherwise by the DAADAO, the OIMO is responsible for the assembly, compilation, and submissionpresentation of the accreditationauthorization submission package. The accreditationauthorization submission package contains the following documents:• The PCI operations plan (including all PCIIssuing Facilities Standard Operating Procedures [(SOPs]) and attachments);• [SP 800-37800-37-1] accreditationauthorization letters;• The assessment report; and• TheCorrective correctiveActions actionsPlan plan(CAP) (if required).
The PCI operations plan contains the PCI’s policies, procedures, and processes for all the major PCIPIV functional areas. The operations plan provides a complete picture of the structure, management, and operations of thean PCIissuer to the Assessor and DAADAO. Appendix D provides a templatetemplates of what to include in the PCI operations plan for PIV Card Issuers and for Derived PIV Credential Issuers. One of the most significant pieces of information contained within the operations plan is the list of PCIissuer controls, how they were implemented, and who is responsible for their management. This description of the PCIissuer controls makes it a simple process for the Assessor to quickly ascertain how they were implemented and by whom.
If certain functions described in the operations plan are outsourced, the PCI’s operation plan can reference or “point to” the external service provider’s operation plan and related documentation, such as support agreements and any contracts. In this manner, the Assessor has access to the information regarding the external service provider’s operations without requiring the PCIissuer to duplicate any documentation.
TheSP 800-37Upon accreditationreceiving lettersand arereviewing the formal authorization to operate the PCI information systems that are directly involved in the issuancepackage and maintenance of PIV Cards.in
The PCI assessment report,preparedconsultation bywith the Assessor, provides the information needed to determine the extent to which the requirements are being met andDAO aredecides expectedwhether to continue as such during futureauthorize operations. For each deficiency that is found, the assessment report must include the potential impact of the deficiency if it continues without correction and the recommended corrective action to correct itissuer. Appendix E provides a template of what to include in the assessment report.The corrective actions plan (CAP), prepared byauthorization thedecision OIMOletter withtransmits the assistance of theauthorization Assessor,decision describesfrom the changes neededDAO to correct deficiencies noted during the assessment with a time frame for completing each change.OIMO
The submits the accreditation submission package to the DAA. 2 Figure 3 illustratesThe theauthorization primarydecision componentsletter ofcontains the accreditation submissionfollowing package.information:2 Accreditation packages may be submitted in eitherAuthorization paperdecision;
orSupporting electronicrationale format.for Appropriatethe measuresdecision; shouldand
beTerms employedand toconditions protectfor the informationauthorization, containedincluding inwhich accreditationissuing packagesfacilities (electronic or paperAuthorization formatBoundary) in accordance with organizationare policyincluded. DAADAO − Description of the PCI’sissuers PIV services, plans, procedures, technical specifications, supported options, and relevant documents (e.g., policies, standard operating procedures).− Report of the PCIissuer control assessments and recommended corrective actions for athe PCIissuer.− Actions to be implemented by athe PCIissuer to remove or reduce deficiencies and risks.− An authorization to operate for each and every information system within the PCI. PCI’Sissuer OPERATIONSauthorization PLANboundary.
PCI’SASSESSMENTOperations REPORTPlanPCI’SAssessment CORRECTIVEReport
Corrective ACTIONSActions PLANPlan (CAP )
SP 800-37 ACCREDITATION LETTERSAuthorization
Figure 3 - Accreditation SubmissionPackageLettersUpon receiving and reviewing the accreditation package and in consultation with the Assessor, the DAA decides whether to authorize operations of the PCI. The accreditation decision letter transmits the accreditation decision from the DAA to the OIMO. The accreditation decision letter contains the following information:authorization
• Accreditation decision;
• Supporting rationale for the decision; and
• Terms and conditions for the , including which PCIFs are included.decision letter (see Appendix F for examples) informs the OIMO that the
The accreditation PCIissuer is— (i) authorized to operate; (ii) authorized to operate on an interim basis; or (iii) not authorized to operate. The supporting rationale includes the justification for the DAA’sDAO’s decision. The terms and conditions for the authorization provide a description of any limitations or restrictions placed on the operation of the PCIissuer, including which PCIFsissuing facilities are included in the decision. The accreditationauthorization decision letter is attached to the original accreditationauthorization submission package and becomes the accreditationauthorization decision package.
The DAADAO sends the accreditationauthorization decision package to the OIMO and retains a copy of it. The OIMO carefully reviews the terms and conditions of authorization before initiating the necessary steps for PCIissuer operations. Both parties mark the accreditationauthorization decision package appropriately for storage under the organization’s record retention policy. Figure 3 - Authorization Submission Package