Certification and Accreditation

Certification and Accreditation (C&A or CnA) is a process for implementing any formal process. It is a systematic procedure for evaluating, describing, testing and authorizing systems or activities prior to or after a system is in operation. The C&A process is used extensively across the world.

Definitions

Certification is a comprehensive evaluation of a process, system, product, event, or skill typically measured against some existing norm or standard. Industry and/or trade associations will often create certification programs to test and evaluate the skills of those performing services within the interest area of that association. But testing laboratories may also certify that certain products meet pre-established standards, or governmental agencies may certify that a company is meeting existing regulations (such as emission limits).

Accreditation is the formal declaration by a neutral third party that the certification program is administered in a way that meets the relevant norms or standards of certification program (such as ISO/IEC 17024). Many nations have established specific bodies. In the United Kingdom, for example, an organization known as United Kingdom Accreditation Service (UKAS) has been established as the nation's official accreditation body. Most European nations have similar organizations established to provide accreditation services within their borders.

There is no such "approved" accreditation body within the United States, however. As a result, over the years multiple accreditation bodies have become established to address the accreditation needs of specific industries or market segments. Some of these accreditation services are for profit entities, however the majority are not-for-profit bodies that provide accreditation services as part of their mission.

Certification and Accreditation (C&A) in Information Secu Certification and Accreditation is a two-step process that ensures security of information systems.[1] Certification is the process of evaluating, testing, and examining security controls that have been pre-determined based on the data type in an information system. The evaluation compares the current systems’ security posture with specific standards. The certification process ensures that security weaknesses are identified and plans for mitigation strategies are in place. On the other hand, accreditation is the process of accepting the residual risks associated with the continued operation of a system and granting approval to operate for a specified period of time.

References

  1. ↑ https://www.academia.edu/6019006/Certification_and_Accreditation_AKA_Assessment_and_Authorization

External links

This article is issued from Wikipedia - version of the 11/18/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.