View source for Department of Defense Information Assurance Certification and Accreditation Process

The '''DoD Information Assurance Certification and Accreditation Process''' ('''DIACAP''') is the United States Department of Defense (DoD) process to ensure that [[risk management]] is applied on information systems (IS).  DIACAP defines a DoD-wide formal and standard set of activities, general tasks and a management structure process for the [[Cyber security certification|certification]] and [[accreditation]] (C&A) of a DoD IS that will maintain the [[information assurance]] (IA) posture throughout the [[Systems Development Life Cycle|system's life cycle]].

==History==
DIACAP is the result of a [[NSA]] directed shift in underlying security paradigm and succeeds its predecessor: [[DITSCAP]]. 

An interim version of the DIACAP was signed July 6, 2006 and superseded DITSCAP.  The final version is titled Department of Defense Instruction 8510.01 and was signed on November 28, 2007.  It supersedes the Interim DIACAP Guidance.

One major change in DIACAP from [[DITSCAP]] is the embracing of the idea of [[information assurance]] controls (defined in DoDD 8500.1 and DoDI 8500.2) as the primary set of security requirements for all automated information systems (AISs).  The IA Controls are determined based on the system's [[mission assurance]] category (MAC) and confidentiality level (CL).

==Process==
* System Identification Profile
* DIACAP Implementation Plan
** Validation
* Certification Determination
* DIACAP Scorecard
* POA&M
* Approval to Operate Decision

== References ==
* [http://iase.disa.mil/diacap/ DIACAP Guidance at the DoD Information Assurance Support Environment]
* [https://diacap.iaportal.navy.mil/ DIACAP Knowledge Service] (requires DoD [[Public key infrastructure|PKI]] certificate)
* [http://govitwiki.com/wiki/Defense_Information_Assurance_Certifications_and_Accreditation_Process_(DIACAP) Full list of DIACAP Phases] with instructions at GovITwiki.
* [http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf DPT. Of Defense Instruction 8510.01: ''DoD Information Assurance Certification and Accreditation Process'']
* [http://www.dtic.mil/whs/directives/corres/pdf/850001p.pdf Department of Defense Directive 8500.1: ''Information Assurance (IA)'']
* [http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf Department of Defense Instruction 8500.2:  ''Information Assurance (IA) Implementation'']

[[Category:United States Department of Defense|Information Assurance Certification and Accreditation Program]]
[[Category:Computer security procedures]]