View source for Department of Defense Information Assurance Certification and Accreditation Process

{{short description|Computer security process}}
{{Notability|date=August 2016}}
The '''DoD Information Assurance Certification and Accreditation Process''' ('''DIACAP''') is a deprecated [[United States]] [[United States Department of Defense|Department of Defense]] (DoD) process meant to ensure companies and organizations applied [[risk management]] to [[information system]]s (IS).  DIACAP defined a DoD-wide formal and standard set of activities, general tasks and a management structure process for the [[Cyber security certification|certification]] and [[accreditation]] (C&A) of a DoD IS which maintained the [[information assurance]] (IA) posture throughout the [[Systems Development Life Cycle|system's life cycle]].

As of May 2015, the DIACAP was replaced by the "[[Risk management framework|Risk Management Framework]] (RMF) for DoD Information Technology (IT)".  Although re-accreditations via DIACAP continued through late 2016, systems that had not yet started accreditation by May 2015 were required to transition to the RMF processes.<ref>{{cite web|title=DoDI 8510.01 "Risk Management Framework (RMF) for DoD Information Technology (IT)" March 14th 2014|url=http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf|archive-url=https://web.archive.org/web/20140330004529/http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf|url-status=dead|archive-date=March 30, 2014|accessdate=29 March 2014}}</ref>    The DoD RMF aligns with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF).<ref>{{cite web|title=NIST Risk Management Framework|date=30 November 2016 |url=http://csrc.nist.gov/groups/SMA/fisma/framework.html}}</ref><ref>{{cite web|title=NIST:Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach|url=http://csrc.nist.gov/publications/PubsSPs.html#800-37}}</ref>

==History==
DIACAP resulted from an [[NSA]] directed shift in underlying security approaches. An interim version of the DIACAP was signed July 6, 2006, and superseded the interim [[DITSCAP]] guidance.  The final version is called ''Department of Defense Instruction 8510.01,'' and was signed on March 12, 2014 (previous version was November 28, 2007).

DODI 8500.01 Cybersecurity
[https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/850001_2014.pdf http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf],

DODI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)
[https://fas.org/irp/doddir/dod/i8510_01.pdf https://fas.org/irp/doddir/dod/i8510_01.pdf]

DIACAP differed from DITSCAP in several ways—in particular, in its embrace of the idea of [[information assurance]] controls (defined in DoDD 8500.1 and DoDI 8500.2) as the primary set of security requirements for all automated information systems (AISs).  Applicable IA Controls were assigned based on the system's [[mission assurance]] category (MAC) and confidentiality level (CL).

==Process==
* System Identification Profile
* DIACAP Implementation Plan
* Validation
* Certification Determination
* DIACAP Scorecard
* POA&M
* Authorization to Operate Decision
* Residual Risk Acceptance

== See also ==

* [[Risk Management Framework]] - successor to DIACAP

== References ==
{{Reflist}}
* [https://web.archive.org/web/20090321114448/http://iase.disa.mil/diacap/ DIACAP Guidance at the DoD Information Assurance Support Environment ]
* [https://web.archive.org/web/20090825102450/https://diacap.iaportal.navy.mil/ DIACAP Knowledge Service] (requires DoD [[Public key infrastructure|PKI]] certificate)
* [https://cyber.trackr.live DIACAP Control Indexer]
* [http://govitwiki.com/wiki/Defense_Information_Assurance_Certifications_and_Accreditation_Process_(DIACAP) Full list of DIACAP Phases] with instructions at GovITwiki.
* [https://web.archive.org/web/20090825030249/http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf DPT. Of Defense Instruction 8510.01: ''DoD Information Assurance Certification and Accreditation Process'']
* [https://web.archive.org/web/20070714025033/http://www.dtic.mil/whs/directives/corres/pdf/850001p.pdf Department of Defense Directive 8500.1: ''Information Assurance (IA)'']
* [https://web.archive.org/web/20091122200729/http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf Department of Defense Instruction 8500.2:  ''Information Assurance (IA) Implementation'']

== External links ==
* [https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/ DoD Approved 8570 Baseline Certifications]

[[Category:Computer security accreditations]]
[[Category:United States Department of Defense information technology|Information Assurance Certification and Accreditation Program]]


{{US-law-stub}}