BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.9 Authorization Decisions (was: Accreditation Decisions)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 2 PREPARATION FOR ASSESSMENT AND AUTHORIZATION part of 2

Title changed

Before · SP 800-79-1

Accreditation Decisions

After · SP 800-79-2

AccreditationAuthorization Decisions

Control changed

Before · SP 800-79-1

An accreditation decision is a judgment made by the DAA regarding authorizing operation of a PCI and its facilities. The DAA reviews the results of the assessment, considers the impact to the organization of any identified deficiencies, and then decides whether to authorize the operation of the PCI and its facilities. In doing so, the DAA is agreeing to accept the security and privacy risks to the organization in issuing and maintaining PIV Cards.

During the accreditation decision process, the DAA must evaluate the assessment findings for the PCI and each facility within the accreditation boundary. If the PCI has outsourced some of its services or functions, the DAA must review all relevant assessments and accreditations that have been granted to the external service provider and include them as a part of the overall evaluation of risk to the organization.

An authorization decision by a DAA must always be granted for a specific PCI before commencement of operations, and for each PCI there can be only one authorization decision. In issuing this decision, the DAA must indicate the PCI accreditation boundary to which the authorization applies. A DAA grants an authorization to a PCI, and then specifies which facilities (along with any exceptions or restrictions) are permitted to operate under that authorization. This allows the PCI and any authorized facilities to begin operations while any remaining facilities focus on addressing deficiencies with FIPS 201-1 and its supporting documents. At a later date, these latter facilities can be reassessed. After reviewing the new findings, the DAA can reissue the authorization for the PCI and expand the accreditation boundary to which the authorization applies by including the newly assessed facilities.

The major input to the accreditation decision is the assessment report. To ensure the assessment report is properly interpreted and the justification for the accreditation decision properly communicated, the DAA should meet with the Assessor, the OIMO, and the PCI Facility Manager(s) prior to issuing an accreditation decision to discuss the assessment findings and the terms and conditions of the authorization.

There are three accreditation alternatives that can be rendered by the DAA:

• Authorization to operate;
• Interim authorization to operate; or
• Denial of authorization to operate.

After · SP 800-79-2

An accreditationauthorization decision is a judgment made by the DAADAO regarding authorizing operation of aan PCIissuer and its facilities. The DAADAO reviews the results of the assessment, considers the impact to the organization of any identified deficiencies, and then decides whether to authorize the operation of the PCIissuer and its facilities. In doing so, the DAA isDAO agreeingagrees to accept the security and privacy risks to theof organization in issuing and maintaining PIV Cards or Derived PIV Credentials.

 During the accreditationauthorization decision process, the DAADAO must evaluate the assessment findings for the PCIissuer and for each issuing facility within the accreditationauthorization boundary. If the PCIissuer has outsourced some of its services or functions, the DAADAO must review all relevant assessments and accreditationsauthorizations that have been granted to the external service provider and include them as a part of the overall evaluation of risk to the organization.

An authorization decision by a DAADAO must always be granted for a specific PCI or DPCI before commencement of operations, and for each PCIissuer there can be only one authorization decision. In issuing this decision, the DAADAO must indicate the PCI accreditationauthorization boundary to which the authorization applies. A DAADAO grants an authorization to aan PCIissuer, and then specifies which facilities (along with any exceptions or restrictions) are permitted to operate under that authorization. This allows the PCIissuer and any authorized issuing facilities to begin operations while any remaining facilities focus on addressing deficiencies with FIPS 201-1 andidentified itsduring supportingthe documentsassessment. At a later date, these latter facilities can be reassessed. After reviewing the new findings, the DAADAO can reissue the authorization for the PCIissuer and expand the accreditationauthorization boundary to which the authorization applies by including the newly assessed facilities.

The major input to the accreditationauthorization decision is the assessment report. To ensure the assessment report is properly interpreted and the justification for the accreditationauthorization decision properly communicated, the DAADAO should meet with the Assessor, the OIMO, and the PCIIssuing Facility Manager(s) prior to issuing an accreditationauthorization decision to discuss the assessment findings and the terms and conditions of the authorization.

There are three accreditationauthorization alternatives that can be rendered by the DAADAO:

• Authorization to operate;
• Interim authorization to operate; or
• Denial of authorization to operate.