UPDAT: 2014 – Risk Management Framework for DOD IT released.
Days 4 & 5 bring the DIACAP/AFCAP Essentials Class to a close. The
biggest things I learned were: CNSSI 4009 is the the official glossary of DOD IA, there is a big difference between theory, policy and practice, Agents of the Certifying Authority (ACA) are official validators and there is a difference between acquisition Mission criticality and IA MAC levels.
Stuff I learned from people in the class:
-AFCA is changing its name (to what?)
DOD is going to put the new IA controls in NCSSI 12-53 (currently in draft)
-a lot of what I need in there is in NIST 800-53
Marines use something called Exacta
Site called securitycritics.org
33-202 is now completely irrelevant and obsolete (not even mentioned ONCE in the class)
Feds call Certification &Accreditation (C&A) “Security authorization”
NIST SP 800-37
Validator Activities & Issue Accreditation Decision
Make certification determination
CA/DAA Package review
Validation procedures were discussed. On day five, we looked at how the validators look at a system.
I thought is was interesting. It should help me get through the EITDR/DIACAP process easier.
Maintain Situational Awareness
Maintain IA Posture