SOW Annex D - Ministerio de Defensa

NATO UNCLASSIFIEDIFB-CO-12546-GAG - SOW Annex DAppendix 1NATO 7. Target of AccreditationThe primary objective of security approval or accreditation is to ensure thatthe implemented CIS conforms with NATO Security Policy and supportingdirectives (and, where appropriate, National equivalent(s)), and the CISspecificsecurity-related documentation (e.g. CSRS). Security approval andaccreditation is the authorisation granted to a CIS to store, process or transmitinformation up to the determined security classification in its operationalenvironment.8. Accreditation DocumentationIn order to grant security approval or accreditation for a CIS, the SecurityApproval or Accreditation Authority should be satisfied that the applicablesecurity requirements will be met by proper enforcement of the SRS(s), withparticular emphasis on the SSRS, and the SecOPs. The SRS(s) form thebasis for an understanding and agreement between the security approval oraccreditation authority and the CIS Operating Authority that the CIS will beoperated in a secure manner.9. Approved SoftwareSoftware used on the system shall be approved by the appropriate SAA. Thisapproval is automatically applied if the software is listed in the ApprovedFielded Product List (AFPL) maintained by NCSA.10. Process of Accreditationa. A security risk assessment of the shall be conductedby the Host Nation (HN) e.g. NATO C3 Agency (NC3A) inconjunction with the SAA and project staffs.b. HN shall produce SRS(s) for the as required. TheSRS(s) shall:(1) Include (generic) Security Operating Procedures(SecOPs).(2) Describe the minimum levels of security deemednecessary to counter risk identified in a risk assessmentof the .(3) Define the security testing requirements and include asecurity test and evaluation (ST&E) plan.(4) Include a Statement of Compliance, including aninterconnection statement, as Annex to the SRS(s)c. The SRS(s) shall be presented to the SAA for approval in duetime to permit timely reviews and resolution of outstandingissues prior to being required operationally.NATO NATO UNCLASSIFIEDPage 12 of 14