An Analysis of the DoD Certification and Accreditation Process

摘要

The Department of Defense (DoD) current strategic vision is to ensure thatinformation superiority is maintained across the full spectrum of operations. Hence, oneof the greatest challenges facing this vision is to secure the information infrastructure.Protection of the infrastructure entails the standoff of a myriad of attacks and maliciousactivity such as denial-of-service, viruses and Trojan horses. A daunting challenge initself, protection of the infrastructure succeeds only with a strong policy, process, andstandard. The current process used to ensure protection is the DoD InformationTechnology Security Certification and Accreditation Process (DITSCAP). It is currentlybeing revised to the DoD Information Assurance Certification and Accreditation Process(DIACAP).This thesis analyzes current and past applications of the DITSCAP to evaluatesuccesses and failures. Due to the large number of personnel who use the process and theastronomical cost associated with traveling to each of their commands, the methodselected to obtain data for analysis was a survey and phone interviews. The survey wasweb-based and the link was emailed to personnel who use the process.The objective of this thesis is to provide recommendations for improving theprocess that should be considered in developing the DIACAP.