Analysis of Automated Solutions for the Certification and Accreditation of Navy Medicine Information Assets.

摘要

The purpose of this study was to determine potential improvements in Navy Medicine's current Certification and Accreditation (C AND A) process. The study examined whether Navy Medicine's C AND A policies are in alignment with DoD, Navy and Federal Government requirements and whether the use of automated C AND A tools could significantly improve Navy Medicine's current C AND A security posture. The primary research reviewed C AND A policy and included a comparative analysis of two cutting edge automated C AND A tools namely, Xacta and eMASS. The findings of the analysis revealed that the use of automated C AND A tools could significantly enhance Navy Medicine's C AND A process and assist Navy Medicine's information assurance personnel who are responsible for the execution of the Navy Medicine C AND A process and approval of Navy Medicine information systems. This study also provided valuable insight in verifying the evidence on how information assurance (IA) controls are addressed within the automated C AND A tools regardless of the C AND A process. The results of the analysis ultimately led to the development of key recommendations that can assist Navy Medicine in selecting the appropriate automated C AND A tool for its C AND A process.