NASA moves away from C&A on IT systems

Certification and accreditation--a backbone requirement of the Federal Information Security Management Act--is no longer a strict requirement at NASA, according to a memo from Jerry Davis, the agency's deputy chief information officer for IT security.

New FISMA guidance (.pdf) from the Office of Management and Budget clearly shifts cybersecurity priorities "away form cumbersome and expensive C&A paperwork processes, in favor of a value-driven, risk-based approach to system security," Davis wrote.

To that end, system administrators in charge of existing systems will not have to recertify their systems this fiscal year, unless an authorizing official requests it. "However, these processes have proven largely ineffective and do not ensure a system's security or a true understanding of the system's risk posture," the memo states.

All new systems must still go through the NASA C&A process, the memo states, "Until a more effective security authorization process is established."

For more:
- see the NASA memo (.pdf)
- read this Nextgov story
- see OMB's fiscal 2010 FISMA guidance (.pdf)

Related Articles:
OMB gives DHS new powers under revised FISMA guidance
Federal cybersecurity staff less confident than bosses about cyber defense
FISMA blasted at House hearing