SECURITY CERTIFICATION

DOCUMENTATION
What is a security certificate?

● A security certificate is a small data file used as an internet security

technique through which the identity,authenticity, and reliability of a website
or a web application is established.
● A security certificate is also known as digital certificate or Secure Socket
Layer(SSL) certificate.
● It is used as a means to provide the security level of a website to general
visitors,Internet service providers(ISP) and web servers.
Documentation Standards

● All information security documents developed must follow the procedures or

best practices of university information security (University of minnesota).
● Exceptions to this standard must be approved by university information
security(UIS).
● Non-Compliance with this standard must be reported to UIS.
Standard and Process
All information security documentation within the scope of this standard must contain:

1.Objective - The purpose of the document.

2.Scope - Identifies to whom and to what assets the standards and process apply.

3.The security accreditation package contains following documents:

1. Approved system security plan

2. Security assessment report
3. Plan of action and milestones.
Standard and process (cont.)
Security Accreditation Package

● The information system owner (ISO) is responsible for the assembly,

compilation and submission of the security accreditation package.
● ISO receives inputs from the information system security officer
(ISSO), certification agent (CA) and senior agency information security
officer (SAISO) during the preparation of the security accreditation
package.
Accreditation decision

● Security accreditation decision.

❏ Authorised to operate or
❏ Authorised to operate on an interim basis under strict terms and conditions or
❏ Not authorised to operate.
● Supporting rationale for the decision.
❏ Provides the Information system owner with the justification for the authorising
official’s decision.
● Terms and conditions for the authorization.
❏ Provides a description of any limitations or restrictions placed on the operation of
the information system that must be adhered to by the information system owner.
Standard and process (cont.)

4. Document Owner- ISO

5. Document Approver - authorising official or designated representative

6. Effective Date - The Date when document was implemented and enforced.

7. Last Reviewed Date - The date on which document was last reviewed for
changes, updates or document retirement.
Documents maintenance
● Current document owners must be updated or affirmed during routine
document maintenance.

● Document owner will determine how often the document requires routine
maintenance but however regular interval must not exceed 3 years from the
prior last reviewed date.
● The authorising official and senior agency information security officer also
retains the copies of the accreditation decision letter and package.
● The documents should be marked and protected appropriately in accordance
with agency policy and retained in accordance with the agency’s record
retention policy.
THANK YOU