DIACAP Activity #3 Make Certification Determination and Accreditation Decision
Once all of the validations have been complete its time for the IA Component to make a certification determination. They examine the system and may call for additional documentation to verify certain IA features. Waivers, memoradums and other documentation may be required for completion of the certification. The IA Component may need additional scan results. This can sometimes make the process much longer than it should be.
Issue Accreditation Decision
Once the all documentation and scans for the certification have been completed it is out of your hands. The IA Component will push the package forward for final Accreditation approval. The DAA usually takes the recommendations of the IA Component so its best to have complied with all of their wishes.
The DAA will issue an ATO, IATO, ATC or IATC.
E2.2. Accreditation Decision. A formal statement by a designated accrediting authority (DAA) regarding acceptance of the risk associated with operating a DoD information system (IS) and expressed as an authorization to operate (ATO), interim ATO (IATO), interim authorization to test (IATT), or denial of ATO (DATO). The accreditation decision may be issued in hard copy with a traditional signature or issued electronically signed with a DoD public key infrastructure (PKI)-certified digital signature. (DOD 8510.1)
More on ATOs & ATC’s
