BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.7 The Relationship between SP 800-79-2 and SP 800-37-1 (was: The Relationship between SP 800-79-1 and SP 800-37)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 2 PREPARATION FOR ASSESSMENT AND AUTHORIZATION part of 2

Title changed

Before · SP 800-79-1

The Relationship between SP 800-79-1 and SP 800-37

After · SP 800-79-2

The Relationship between SP 800-79-1800-79-2 and SP 800-37800-37-1

Control changed

Before · SP 800-79-1

While accreditation is the major topic of both special publications, the goals of accreditation are distinct in SP 800-37 and SP 800-79-1. Accreditation under SP 800-37, as mandated by Appendix III of the Office of Management and Budget (OMB) Circular A-130, focuses on “authorizing processing” of information systems based on an assessment of security at the information system level. Accreditation as discussed herein and as mandated by HSPD-12 is concerned with the assessment of the “reliability” of a PCI to perform its functions in accordance with FIPS 201-1. An accreditation decision granted under SP 800-37 signifies that an organization official accepts responsibility for the security (in terms of confidentiality, integrity, and availability of information) of the information system. Accreditation of a PCI’s reliability under SP 800-79-1 indicates that the organization official agrees to accept the risk that the PCI can operate within the control objectives outlined in HSPD-12 for “secure and reliable forms of identification.” However in both cases, the organization official (Authorizing Official (AO) in the case of SP 800-37, and DAA in the case of SP 800-79-1) accepts responsibility, and is fully accountable for any adverse impacts to the organization if a breach in security, privacy, or policy occurs.

SP 800-79-1 focuses on the accreditation of an organization’s capability and reliability, but depends on adequate security for all the supporting information systems that have been accredited under SP 800-37. Therefore, before the organization official accredits the PCI and its facilities, all PCI information systems used must be accredited.

In many cases, accreditation under SP 800-37 will be granted by an organization official different than the official responsible for accrediting the PCI. The former is an organization official tasked with making a decision on whether to authorize operation of an information system based on its security posture. The latter must be someone designated specifically for authorizing the operation of the PCI after it has been assessed and determined to be compliant with FIPS 201-1 control objectives.

After · SP 800-79-2

While accreditationauthorization is the major topic of both special publications, the goals of accreditationauthorization are distinctdifferent in [SP 800-37800-37-1] and SP 800-79-1800-79-2. AccreditationAuthorization undercompliant to [SP 800-37800-37-1] , as mandated by Appendix III of the Office of Management and Budget (OMB) Circular A-130, focuses on “authorizing processing” of information systems based on an assessment of security at the information system level. AccreditationAuthorization as discussed hereinin this document and as mandated by [HSPD-12] is concerned with the assessment of the “reliability” of aan PCIissuer to perform its Senior Authorizing Official (SAO)

Privacy Official (PO) Designated Authorizing Official (DAO)

Applicant Representative (AR) Assessor

Organization Identity Management Official (OIMO)

Issuing Facility Manager(s) functions in accordance with FIPS 201-1201-2. An accreditationauthorization decision granted under [SP 800-37800-37-1] signifies that an organization official accepts responsibility for the security (in terms of confidentiality, integrity, and availability of information) of the information system. AccreditationAuthorization of aan PCI’sissuer’s reliability under SP 800-79-1800-79-2 indicates that the organization official agreesasserts tothat acceptthe issuer meets the riskcontrol thatobjectives and has the PCIability canto operate within the control objectives outlined in [HSPD-12] for “secure and reliable forms of identification.” within an acceptable level of risk. However in both cases, the organization official (Authorizing Official (AO) in the case of [SP 800-37800-37-1] , and DAADAO in the case of SP 800-79-1800-79-2) accepts responsibility, and is fully accountable for any adverse impacts to the organization if a breach in security, privacy, or policy occurs.

SP 800-79-1800-79-2 focuses on the accreditationauthorization of an organization’s capability and reliability, but depends on adequate security for all the supporting information systems that have been accreditedauthorized under [SP 800-37800-37-1] . Therefore, before the organization official accreditsauthorizes the PCIissuer and its facilities, all relevant PCI or DPCI information systems used must be accreditedauthorized.

In many cases, accreditationauthorization under [SP 800-37800-37-1] will be granted by an organization official different than the official responsible for accreditingauthorizing the PCIissuer. The former is an organization official tasked with making a decision on whether to authorize operation of an information system based on its security posture. The latter must be someone designated specifically for authorizing the operation of thean PCIissuer after it has been assessed and determined to be compliant with FIPS 201-1201-2 control objectives.