SOW Annex D - Ministerio de Defensa

NATO UNCLASSIFIEDIFB-CO-12546-GAG - SOW Annex DAppendix 1NATO d. Each site shall produce:(1) Its own SecOPs.(2) ST&E plan based on the generic version included in theSRS(s).e. The SecOPs and the ST&E plan shall be approved by the localSAA.f. Each node shall securely implement the local againstthe SRS(s) and SecOPs.g. Security testing of the site shall be conducted by the appropriateCIS Operating Authority in coordination with NITC/SECAN.h. Accreditation of each local site shall only be granted by the localSAA after security testing has been successfully completed.i. Once local accreditation has been completed, the CIS OperatingAuthority shall sign and forward a Statement of Compliance(SoC) to the appropriate Security Accreditation Authority (SAA).j. Upon receipt of a signed Statement of Compliance, the SAAshall arrange a security inspection of the NATO site to verifycompliance with the SRS(s) prior to granting accreditation. Theinspection of the NATO site shall be arranged by the SAA on acase-by-case basis.11. Accreditation Decision for ConnectionsThe SAA can only grant security accreditation to connections after statementsof compliance have been received from the local SAAs of the connectingsites. As an exceptional measure, the SAA may grant temporary securityapproval to a connecting site by granting Interim Approval to Operate (IATO).These IATOs shall only be granted for limited time periods (maximum of 12month) after which, if the nodes have not been accredited and certifiedcompliant, the SAA may recommend their disconnection from the NGCS PTCto the appropriate risk owner and declare that the network is being operatedwithout security accreditation or authority.NATO NATO UNCLASSIFIEDPage 13 of 14