Certification and Accreditation: A Program for Practitioner Education

Computer and network systems process information critical to enterprise security. Should these information systems be vulnerable to security failures or attacks, the consequences could be grave. Although individual components may provide security features and assurance of correct policy enforcement, their encompassing systems and subsystems are frequently large and complex. How can a system owner assess the suitability of a system to operate in a particular environment? Factors that will affect this determination include the sensitivity and criticality of the information to be processed; the physical and cyber context in which the system is expected to operate; the personnel who will administer and use the system; as well as a wide variety of technical factors that affect security.