In: Categories » Business » Branding and certification » DCID 6.3
|
DCID 6/3 is the certification and accreditation process used by federal agencies working on intelligence projects (e.g., the CIA). Specifically, information technology projects that require that anyone working on them has a Top Secret, Sensitive Compartmentalized Information (SCI) clearance use the DCID 6/3 process. DCID stands for Director of Central Intelligence Directive and 6/3 refers to the process described in section 6, part 3 of the compendious Director of Central Intelligence Directives.5 The certification and accreditation process that the Intelligence Community (IC) used before DCID 6/3 came along was called DCID 1/16. The DCID 6/3 model is based on certification and accreditation performed on information systems that are characterized by Protection Levels (PL), and DCID 6/3 defines five different protection levels. DCID 6/3 deals only with classified information and its PL model helps ensure that only properly cleared people have access to classified information. Although the DCID 6/3 model was designed for classified information and intelligence work, it is publicly available for review, and any agency or private organization can adopt the methodology, and customize it according to their own unique requirements.The DCID Standards Manual, which defines the DCID 6/3 certification and accreditation process, can be found on the Federation of American Scientists Web site at www.fas.org/irp/offdocs/dcid-6-3-manual.pdf The DCID 6/3 C&A process must also comply with the DCID 6/3 policy manual.The DCID 6/3 policy manual can be found on the Web at www.fas.org/irp/offdocs/DCID_6-3_20Policy.htm. Many of the requirements for IC certification and accreditation are based on physical security, since classified information must always be physically secured. Aside from physical security, the IC puts a lot of emphasis on encryption. The emphasis in these two areas is what really sets apart DCID certification and accreditation from the other C&A methodologies.
|
legal disclaimer
1) Our website is not responsible for the information contained by this article as well for any and all copyright infringements by authors and writers. E-articles is a free information resource. If you suspect this article for any copyright infringements, please read the Terms of service and contact us to investigate the problem.
2) The E-articles directory team is not responsible for inaccuracies, falsehoods, or any other types of misinformation this tutorial may contain and will not be liable for any loss or damage suffered by a user through the user's reliance on the information gained here. Please read the Terms of service
Useful tools and features
If you like this article (tutorial), please link to it from your web page using the information above. Linking to this page, this is the only way to help us improve our service, the same time providing your visitors with a way to improve their online experience.
related articles
Before you’ll be able to start putting together a Certification Package, you’ll need to acquire as much information as possible about the systems or applications you’ll be certifying.You need to be a good detective, and not lose faith when the details appear unclear.The more information you gather the clearer the details will become.You are about to put together an information technology jigsaw puzzle. Initiating Your C&A Project When you begin your C&A project, don&rs...
2. Creditation and Acreditation Handbook Development
In developing the program, you’ll need to write a C&A Handbook that instructs your agency or bureau on how to prepare a Certification Package. The idea is to standardize the development of all Certification Packages that are submitted for evaluation.Without a handbook and a specified process, the Certification Packages will have a different look and feel. If 50 different Certification Packages all have the right information in it, but in different formats, it is going to be very difficult for the...
3. Criteria to Use for Determining the Certification and Accreditation Levels
In order to determine the level at which your information should be certified and accredited, there are seven criteria you should take into consideration: ■ Confidentiality ■ Integrity ■ Availability ■ Interconnection State ■ Processing State ■ Complexity State ■ Mission Criticality I am going to show you how to assign risk and impact ...
4. What Is Certification and Accreditation
Certification and Accreditation is a process that ensures that systems and major applications adhere to formal and established security requirements that are well documented and authorized. Informally known as C&A, Certification and Accreditation is required by the Federal Information Security Management Act (FISMA) of 2002. All systems and applications that reside on U.S. government networks must go through a formal C&A before being put into production, and every three years thereafter. Since accredit...
5. The NIACAP Process
As you recall, the NIACAP C&A model was developed by the CNSS, and its intent is to be used as guidance for the C&A of national security systems. National Security Systems are systems that contain National Security Information (NSI). Classified NSI includes information determined to be either “Top Secret,”“Secret,” or “Confidential” under Executive order 12958,4 which was released by the White House office of the Press Secretary in April 1995. However, NSI may also inc...
6. NIACAP and NIST Phases Differences and Similarities
The NIST process was designed for unclassified information, more commonly known as Sensitive But Unclassified (SBU) information. The framework for the NIST C&A methodology is described in a publication known as NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems. A copy of it is available online at http://csrc.nist. gov/publications/nistpubs/800-37/SP800-37-final.pdf. Both NIST and NIACAP establish a framework to provide ac...
7. DITSCAP Phases
DITSCAP was developed for evaluating and accrediting Department of Defense systems and also includes four phases. DITSCAP was developed and is published by the Defense Information Systems Agency (DISA) and it applies to the acquisition, operation, and on-going support of any Department of Defense system that collects, stores, transmits, or processes unclassified or classified information. It is mandatory for use by all defense agencies. The DITSCAP guidance is described in a document known as DoDI 5200.40...
8. Recognizing the Need for Certification
All general support systems and major applications are required by FISMA and the Office of Management and Budget (OMB) to be fully certified and accredited before they are put into production. Production systems and major applications are required to be reaccredited every three years. Going forward we will refer to systems that require C&A (e.g., general support systems and major applications) simply as information systems. One of the primary objectives of C&A is to force the authorizing official to und...
9. Roles and Responsibilities in Creditation and Accreditation CA
C&A involves a lot of different people all working together on different tasks. There are the folks who develop the C&A program, the folks who prepare Certification Packages, the folks who are held accountable for the Certification Packages, the agency auditors who evaluate the Certification Packages prior to accreditation, and the federal inspectors who audit the agency to make sure that they are doing C&A the right way. Chief Information Officer The agency Chief Information Officer (CIO) ...