Certification and Accreditation

DoDI 5200.40 (DITSCAP) established a standard DoD-wide process, set of activities, general tasks, and a management structure to certify and accredit Information Systems (IS). The DITSCAP used a single document approach. All the information relevant to the C&A was collected into the one document, the System Security Authorization Agreement (SSAA). Additionally, the following activities were necessary:

• Security Test and Evaluation (ST&E)
• Threat, Vulnerability, and Risk Assessments
• Security Assessment Reports

As of 06 July 2006, the DITSCAP has been replaced by the DoD Information Assurance Certification and Accreditation Process (DIACAP).