Transmittal Letter - USPS

1 Transmittal LetterInformation Resource Certification and Accreditation (C&A) ProcessHandbook AS-805-AJune 2015 Transmittal As part of the Postal Service s efforts to enhance security across all technology, this handbook establishes the process and guidance for the Postal Service information resource certification and accreditation (C&A) process. The process provides a framework for characterizing an information resource, determining sensitivity and criticality, defining security requirements and controls, testing security solutions, assessing risk, and evaluating the security posture of Postal Service applications to ensure that appropriate, cost-effective information security controls and processes are This document is available on the Postal Service intranet at Submit comments and questions to.

2 CORPORATE INFORMATION SECURITY OFFICEUNITED STATES POSTAL SERVICE4200 WAKE FOREST ROADRALEIGH NC 27668-1510 Comments may also be sent by e-mail to Use AS-805-A in the subject Date. This handbook is effective (A) Randy MiskanicChief Information Officer and Executive Vice PresidentJune 2015iiiContents1 Introduction..11-1 About This Handbook .. 11-2 Purpose of Certification and Accreditation.. Policy Owner .. Handbook Questions or Comments .. 21-3 Importance of Certification and Accreditation .. 21-4 Supporting Documentation.. 22 Roles and Responsibilities.

3 32-1 Chief Inspector .. 32-2 Executive Vice President and Chief Information Officer .. 52-3 Vice President, Information Technology .. 52-4 Manager, Computer Operations .. 62-5 Manager, Corporate Information Security Office .. 62-6 Vice Presidents of Functional Business Areas .. 62-7 Executive Sponsors .. 72-8 Business Relationship Management Portfolio Managers .. 82-9 Project Managers .. 92-10 Chief Privacy Officer .. 92-11 Certifier .. 92-12 Accreditor .. 102-13 Information Systems Security Officers .. 102-14 Information Systems Security Representatives.

4 112-15 Contracting Officers and Contracting Officer Representatives .. 122-16 Business Partners .. 122-17 Disaster Recovery Services .. 132-18 Functional System Coordinators .. 132-19 Functional System Gatekeepers.. 133 Information Designation and Control ..153-1 Elements of the Certification and Accreditation Process .. 153-2 What the Certification and Accreditation Process Applies To .. Typical Information Resources .. Field Information Resources .. 173-3 Frequency of Certification and Accreditation .. 173-4 Funding .. 173-5 Certification and Accreditation Core Team.

5 17 Information Resource Certification and Accreditation (C&A) ProcessivHandbook AS-805-A4 Certification and Accreditation Process ..194-1 Phase 1 Initiate and Plan .. Objectives .. Deliverables .. Roles and Responsibilities .. Activities .. Register Information Resource in Enterprise Information Repository .. Hold Certification and Accreditation Meeting .. Assign Information Systems Security Representative .. 204-2 Phase 2 Requirements .. Objectives .. Deliverables .. Roles and Responsibilities .. Activities.

6 Review Documentation .. Document Application Characteristics .. Conduct Business Impact Assessment .. Update Plan of Action and Milestones and Enterprise Information Repository .. 254-3 Phase 3 Design .. Objectives .. Deliverables .. Roles and Responsibilities .. Activities .. Analyze Requirements .. Develop Network Architecture Diagrams.. Document Security Specifications.. Identify Potential Security .. Controls .. Select/Design Security Controls .. Develop Security Plan .. Conduct Site Security Review.

7 314-4 Phase 4 Build .. Objectives .. Deliverables .. Roles and Responsibilities .. Activities .. Develop, Acquire, and Integrate Information Security Controls .. Harden Information Resources .. Develop Standard Operating Procedures .. Develop Operational Security Training Materials.. Incorporate Security Requirements in Service Level .. Agreements and Trading Partner Agreements .. Register Information Resources in eAccess .. 34 ContentsJune Initiate Contingency Planning .. Identify Connectivity Requirements.

8 354-5 Phase 5 System Integration Testing .. Objectives .. Deliverables .. Roles and Responsibilities .. Activities .. Develop Security Test and Evaluation Plan .. Conduct Operational Security Training .. Complete Contingency Planning .. 394-6 Phase 6 Customer Acceptance Testing .. Objectives .. Deliverables .. Roles and Responsibilities .. Activities .. Conduct Security Code Review.. Conduct the Security Test and Evaluation .. Conduct Vulnerability Scans .. Conduct Penetration Test .. Conduct Independent Reviews.

9 Assess Risks .. Conduct Risk Assessment and Develop Risk Mitigation Plan.. ISSO Evaluates C&A Documentation .. ISSO Prepares C&A Evaluation Report .. ISSO Escalates Security Concerns or Forwards C&A Package .. Certifier Escalates Security Concerns or Certifies Information Resource .. Accreditor Escalates Security Concerns or Accredits Information Resource .. VP IT and VP Functional Business Area Prepare and Sign Risk Acceptance Letter (if Required) .. 484-7 Phase 7 Governance Compliance .. 534-8 Phase 8 Release and Production.

10 Objectives .. Deliverables .. Roles and Responsibilities .. Activities .. Data Conversion .. Deploy Information Resource .. Operate Information Resource.. Test Information Resource Contingency Plans .. Maintain Information Resource .. Reassess Risks and Upgrade Security Controls .. Monitor Operations and Enhance Security Posture .. 55 Information Resource Certification and Accreditation (C&A) ProcessviHandbook Periodically Test Security Controls .. Update Certification and Accreditation Documentation Package.