Appendix F SAMPLE TRANSMITTAL AND DECISION LETTERS
All changes in this version
Title changed
Before · SP 800-79-1
SAMPLE TRANSMITTAL AND DECISION LETTERS
After · SP 800-79-2
SAMPLE TRANSMITTAL AND DECISION LETTERS
Control changed
Before · SP 800-79-1
Sample Assessment/Accreditation Package Transmittal Letter
From: Organization Identity Management Official Date:
To: Designated Accreditation Authority (DAA)
Subject: PCI Accreditation Package for [PCI]
An assessment of the [PCI NAME] located at [PCI Location and PCIF Locations] has been conducted in accordance with NIST Special Publication (SP) 800-79-1, Guidelines for the Accreditation of PIV Card Issuers and the [ORGANIZATION] policy on PCI accreditation. The attached accreditation package contains— (i) the PCI operations plan; (ii) the assessment report; (iii) a corrective actions plan (CAP); and (iv) An SP 800-37 accreditation letter for each information system within the PCI.
The PCI operations plan, its policies, procedures, and processes have been assessed by [ASSESSOR] using the assessment methods and procedures defined in SP 800-79-1 and specified in the assessment report to determine the extent to which the requirements under HSPD-12 and FIPS 201-1 are exhibited. The CAP describes the corrective actions that we plan to perform to remove or reduce any remaining deficiencies detected in the PCI’s operations. Sample Accreditation Decision Letter (Authorization to Operate)
After reviewing the results of the accreditation package of the [PCI], I have determined that the PCI’s policies, procedures, and processes are in compliance both with FIPS 201-1 and our organization’s own policies, regulations and standards. Accordingly, I am issuing an authorization to operate (ATO) the PCI’s services. The PCI is accredited without any restrictions or limitations. This accreditation is my formal declaration that the requirements of HSPD-12 are being satisfied by the PCI.
This ATO also applies to facilities under the PCI. Included is a list of facilities authorized to operate under this accreditation decision.
This accreditation and ATO will remain in effect for 3 years from the date of this letter if— (i) all required documentation is updated annually; (ii) a lifecycle walkthrough is completed annually and the results sent to me within thirty (30) days of completion; and (iii) no deficiencies are identified during the walkthrough that would increase the risk to the organization’s mission.
A copy of this letter and all supporting accreditation documentation shall be retained in Sample Accreditation Decision Letter (Interim Authorization to Operate)
After reviewing the results of the assessment of the [PCI], I have determined that the PCI does not satisfy the requirements identified in FIPS 201-1 and the organization’s policies, regulations, and standards. However, I have determined that there is an overarching need for the PCI to provide the needed services due to mission necessity and other considerations. Accordingly, I am issuing an interim authorization to operate (IATO) the PCI’s services. Operation of the PCI must be performed in accordance with the enclosed terms and conditions during the IATO period. The PCI is not considered accredited during the IATO period.
This IATO also applies to facilities under the PCI. Included is a list of facilities authorized to operate during this interim period, along with specific limitations or restrictions that apply.
This interim authorization to operate is valid for a maximum till close of business on <date> [not to exceed three months]. This interim authorization will remain in effect as long as— (i) the required status reports for the PCI are submitted to this office every month; (ii) the problems or deficiencies reported from the accreditation do not result in additional risk that is deemed unacceptable; and (iii) continued progress is being made in reducing or eliminating the deficiencies in accordance with the corrective actions plan (CAP). At the end of IATO period, the PCI must either be accredited and authorized to operate, or the authorization for further operation will be denied. A second IATO will be granted only in extenuating circumstances. This office will review the CAP submitted with the accreditation package during the IATO period and monitor progress on removal or reduction of concerns and discrepancies before re- accreditation is initiated.
A copy of this letter and all supporting accreditation documentation shall be retained in Sample Accreditation Decision Letter (Denial of Authorization to Operate)
After reviewing the results of the assessment of the [PCI] and the supporting evidence provided in the associated accreditation package, I have determined that the requirements identified in FIPS 201-1 and the organization’s policies, regulations, and standards are not being exhibited by the PCI. Accordingly, I am issuing a denial of authorization to operate (DATO) to the PCI and its facilities. The PCI is not accredited and [MAY NOT BE PLACED INTO OPERATION or ALL CURRENT OPERATIONS MUST BE HALTED].
The corrective actions plan (CAP) is to be pursued immediately to ensure that proactive measures are taken to correct the deficiencies found during the assessment. Re- accreditation is to be initiated at the earliest opportunity to determine the effectiveness of correcting the deficiencies.
A copy of this letter and all supporting accreditation documentation shall be retained in
After · SP 800-79-2
Sample Assessment/Accreditation Package Transmittal Letter
From: Organization Identity Management Official Date:
To: Designated Accreditation Authority (DAA)
Subject: PCI Accreditation Package for [PCI]
An assessment of the [PCI NAME] located at [PCI Location and PCIF Locations] has been conducted in accordance with NIST Special Publication (SP) 800-79-1, Guidelines for the Accreditation of PIV Card Issuers and the [ORGANIZATION] policy on PCI accreditation. The attached accreditation package contains— (i) the PCI operations plan; (ii) the assessment report; (iii) a corrective actions plan (CAP); and (iv) An SP 800-37 accreditation letter for each information system within the PCI.
The PCI operations plan, its policies, procedures, and processes have been assessed by [ASSESSOR] using the assessment methods and procedures defined in SP 800-79-1 and specified in the assessment report to determine the extent to which the requirements under HSPD-12 and FIPS 201-1 are exhibited. The CAP describes the corrective actions that we plan to perform to remove or reduce any remaining deficiencies detected in the PCI’s operations. Sample Accreditation Decision Letter (Authorization to Operate)
After reviewing the results of the accreditation package of the [PCI], I have determined that the PCI’s policies, procedures, and processes are in compliance both with FIPS 201-1 and our organization’s own policies, regulations and standards. Accordingly, I am issuing an authorization to operate (ATO) the PCI’s services. The PCI is accredited without any restrictions or limitations. This accreditation is my formal declaration that the requirements of HSPD-12 are being satisfied by the PCI.
This ATO also applies to facilities under the PCI. Included is a list of facilities authorized to operate under this accreditation decision.
This accreditation and ATO will remain in effect for 3 years from the date of this letter if— (i) all required documentation is updated annually; (ii) a lifecycle walkthrough is completed annually and the results sent to me within thirty (30) days of completion; and (iii) no deficiencies are identified during the walkthrough that would increase the risk to the organization’s mission.
A copy of this letter and all supporting accreditation documentation shall be retained in Sample Accreditation Decision Letter (Interim Authorization to Operate)
After reviewing the results of the assessment of the [PCI], I have determined that the PCI does not satisfy the requirements identified in FIPS 201-1 and the organization’s policies, regulations, and standards. However, I have determined that there is an overarching need for the PCI to provide the needed services due to mission necessity and other considerations. Accordingly, I am issuing an interim authorization to operate (IATO) the PCI’s services. Operation of the PCI must be performed in accordance with the enclosed terms and conditions during the IATO period. The PCI is not considered accredited during the IATO period.
This IATO also applies to facilities under the PCI. Included is a list of facilities authorized to operate during this interim period, along with specific limitations or restrictions that apply.
This interim authorization to operate is valid for a maximum till close of business on <date> [not to exceed three months]. This interim authorization will remain in effect as long as— (i) the required status reports for the PCI are submitted to this office every month; (ii) the problems or deficiencies reported from the accreditation do not result in additional risk that is deemed unacceptable; and (iii) continued progress is being made in reducing or eliminating the deficiencies in accordance with the corrective actions plan (CAP). At the end of IATO period, the PCI must either be accredited and authorized to operate, or the authorization for further operation will be denied. A second IATO will be granted only in extenuating circumstances. This office will review the CAP submitted with the accreditation package during the IATO period and monitor progress on removal or reduction of concerns and discrepancies before re- accreditation is initiated.
A copy of this letter and all supporting accreditation documentation shall be retained in Sample Accreditation Decision Letter (Denial of Authorization to Operate)
After reviewing the results of the assessment of the [PCI] and the supporting evidence provided in the associated accreditation package, I have determined that the requirements identified in FIPS 201-1 and the organization’s policies, regulations, and standards are not being exhibited by the PCI. Accordingly, I am issuing a denial of authorization to operate (DATO) to the PCI and its facilities. The PCI is not accredited and [MAY NOT BE PLACED INTO OPERATION or ALL CURRENT OPERATIONS MUST BE HALTED].
The corrective actions plan (CAP) is to be pursued immediately to ensure that proactive measures are taken to correct the deficiencies found during the assessment. Re- accreditation is to be initiated at the earliest opportunity to determine the effectiveness of correcting the deficiencies.
A copy of this letter and all supporting accreditation documentation shall be retained in