Obtaining Information Assurance (IA) accreditation for systems initially deployed without ia considerations

The Government desires all DoD systems to achieve Network Centric capabilities, to be able to make rapid decisions and information sharing across the battle space. This will allow situational awareness throughout the battle space through secure critical intelligence information sharing. Use of the information domain via effective Information Assurance (IA) has been identified as an area that must be addressed and improved. Information Assurance accreditation becomes especially challenging when systems have already been deployed without any IA considerations. This paper discusses the process and the work involved when a system (of a small, tactical nature and has a certain Mission Assurance Category- MAC assigned to it) that has already been developed and deployed needs to work toward IA accreditation. The various steps that need to be taken toward the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) accreditation for a system in this category are covered in this paper. General information about the Army Regulations, DoD Directive 8500.2, Army Regulation - AR 25-2, AR 380-5, and the Security Technical Implementation Guides (STIGS) for the OS, Application, Database (DB) Networking and Access Control STIGS will be covered.