BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.9.3 Denial of Authorization to Operate (DATO) (was: Denial of Authorization to Operate)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 2 PREPARATION FOR ASSESSMENT AND AUTHORIZATION part of 2.9

Title changed

Before · SP 800-79-1

Denial of Authorization to Operate

After · SP 800-79-2

Denial of Authorization to Operate (DATO)

Control changed

Before · SP 800-79-1

If, after reviewing the results of the assessment phase, the DAA deems operation of the PCI to be unacceptable, a denial of authorization to operate (DATO ) shall be transmitted to the OIMO. Failure to receive authorization to operate indicates that there are major deficiencies in reliably meeting the requirements of FIPS 201-1 and its related documents. The PCI is not accredited and must not be allowed to operate. If the PCI is currently in operation, all functions must be halted including all operations in its facilities. If the PCI was previously accredited and had issued PIV Cards under an ATO, the OIMO along with the PCIF Manager(s) should consider whether a revocation of PIV Cards is necessary. The DAA and the Assessor should work with the OIMO and PCIF Manager(s) to ensure that proactive measures are taken to correct the deficiencies.

A PCI must not be authorized to operate if one or more of its critical information systems has not been accredited or is issued a DATO under SP 800-37. In the case where an IATO (under SP 800-37) has been issued for an information system within the PCI, the DAA may issue no greater than an IATO to the PCI. Once the SP 800-37 IATO is replaced with an SP 800-37 ATO, the DAA can issue a SP 800-79-1 ATO. If the SP 800-37 ATO expires for one or more of information systems during the course of operation of a PCI, the OIMO shall assess the criticality of the system for PCI operations and present the analysis to the DAA. The DAA then can exercise the following options:

• Specify a short time during which the information systems of the PCI must be re- accredited under SP 800-37 without changing the PCI’s ATO status;

• Downgrade the current SP 800-79-1 ATO to an IATO; or

• If circumstances warrant, issue a SP 800-79-1 DATO and halt all PCI operations.

After · SP 800-79-2

If, after reviewing the results of the assessment phase, the DAADAO deems operation of the PCIissuer to be unacceptable, a denial of authorization to operate (DATO ) shall be transmitted to the OIMO. Failure to receive authorization to operate indicates that there are major deficiencies in reliably meeting the requirements of FIPS 201-1201-2 and its related documents. The PCIissuer is not accreditedauthorized and must not be allowed to operate. If theissuance PCIservices isare currently in operation, all functions must be halted including all operations inat itsthe facilitiesany issuing facility. If thean PCIissuer was previously accreditedauthorized and had issued PIV Cards or Derived PIV Credentials under an ATO, the OIMO along with the PCIFIssuing Facility Manager(s) should consider whether a revocation of PIV Cards isand their Derived PIV Credentials are necessary. The DAADAO and the Assessor should work with the OIMO and PCIFIssuing Facility Manager(s) to ensure that proactive measures are taken to correct the deficiencies.

A PCI must not be authorized to operate if one or more of its critical information systems has not been accredited or is issued a DATO under SP 800-37. In the case where an IATO (under SP 800-37) has been issued for an information system within the PCI, the DAA may issue no greater than an IATO13 toNote theThe PCI. Once the SP 800-37/DPCI IATO is replaced with an SP 800-37 ATO, the DAA can issue a SP 800-79-1 ATO. If the SP 800-37 ATO expires for one or more of information systems during the course of operation of a PCI, the OIMObe shallaffected assessby the criticality of theunderlying system for PCI operations and present the analysis to the DAA. The DAA then can exercise the following options:

• Specify a short time during which the information systems of the PCI must be re- accredited under SP 800-37 without changing the PCI’s ATOauthorization status;

• Downgrade the current SP 800-79-1 ATO to an IATO; or

• If circumstances warrant, issue a SP 800-79-1 DATO and halt(see allSection PCI2.9.3 operations).