Computer Science and Technology: Overview of Computer Security Certification and Accreditation

摘要

This overview summarizes how to establish and carry out a program and a technical process for computer security certification and accreditation of sensitive computer applications. The overview identifies and briefly describes the steps involved in performing computer security certification and accreditation; it identifies and briefly discusses important issues in managing a computer security certification and accreditation program; and it identifies and briefly describes the principal functional roles needed within an organization to carry out such a program. Recertification and reaccreditation and its relation to change control are also touched upon. A discussion of evaluation techniques to be used for certification includes risk analysis, EDP audit, VV&T (verification, validation, and testing), and security safeguard reviews. The relation of these to the system lifecycle is indicated.