This Guideline is intended for use by ADP managers and technical staff in establishing and carrying out a program and a technical process for computer security certification and accreditation of sensitive computer applications.  It identifies and describes the steps involved in performing computer security certification and accreditation; it identifies and discusses important issues in managing a computer security certification and accreditation; it identifies and discusesses the principal functional roles needed within an organization to carry out such a program; and it contains sample outlines of an Application Certification Plan and a Security Evaluation Report as well as a sample Accreditation Statement and sensitivity classification scheme.  A discussion of recertification and reaccreditation and its relation to change control is also included.  The Guideline also relates certification and accreditation to risk analysis, EDP audit, validation, verification and testing (VV&T), and the system life cycle.  A comprehensive list of references is included.

This publication provides a guideline to be used by Federal organizations in the selection and evaluation of techniques for automatically verifying the identity of individuals seeking access to computer systems and networks via terminals, where controlled acceddibility is required for security purposes.  The guideline describes various techniques for verifying identity and provides a set criteria for the evaluation of automated identification systems embodying techniques.

This publication provides guidelines for use by Federal ADP organizations in implementing the computer security safeguards necessary for compliance with Public Law 93-579, the Privacy Act of 1974.  A wide variety of technical and related procedural safeguards are described.  These fall into three broad categories: Physical security, information management practices, and computer system/network security controls.  As each organization processing personal data has unique characteristics, specific organizations should draw upon the material provided in order to select a well-balanced combination of safeguards which meets their particular requirements.