System Accreditation

Phase 1 – Scoping and Planning

During the preliminary stage of the accreditation process, the system scope is defined and activities are planned. The approach varies depending on project type, end user, and the applicable security context, including classification levels, governing policies, and operational requirements.

Organizations often face challenges at this stage related to coordination, unclear ownership, and inefficient planning cycles, where excessive meetings and fragmented inputs slow progress and create misalignment between stakeholders.

As a manufacturer of Communications and Information Systems (CIS), Terma brings extensive, hands-on experience in planning accreditation activities. Drawing on proven internal practices, we can either guide or take direct responsibility for structuring the process, ensuring efficient coordination and timely preparation, collection, and exchange of required information.

Phase 2 – Requirements and Risk Assessment

In this phase, applicable security requirements are identified based on the CIS scope, classification level, and governing policies defined by NATO frameworks such as AC/35-D/2005-REV3. These requirements are not freely chosen but derived from established control sets and tailored to the specific system context. Requirements validation and security testing activities are conducted, and a formal risk assessment is performed to evaluate threats, vulnerabilities, and potential impacts across the CIS environment.

Challenges typically relate to interpreting and tailoring baseline requirements to their specific solutions, leading to either over-implementation or critical gaps. The complexity of aligning multiple stakeholders, documentation standards, and evolving threat landscapes can result in inconsistent risk assessments, unclear justification of residual risks, and delays in collaboration with accreditation authorities.

Terma supports or leads this phase by bringing in dedicated specialists across key cybersecurity disciplines. This includes expertise in System Security Engineering, Governance, Risk and Compliance (GRC), and security testing, as well as practical experience with auditing best practices. With structured methodologies and accreditation experience, Terma ensures that requirements are correctly interpreted, risks are consistently assessed, and all outputs are aligned with accreditation expectations, reducing rework and accelerating the overall process.

Phase 3 – Audit and Approval

During this phase, the audit plan is formalized and executed. Security controls are tested against the defined requirements, findings are documented and evaluated, and the residual risk associated with the CIS is determined. As a best practice, audits are conducted both immediately prior to and shortly after the system enters operation to ensure compliance and validate the effectiveness of implemented controls in a live environment.

The primary difficulty in this phase is the execution of repetitive, requirement-driven testing activities. These efforts are often labor-intensive and prone to human error, which can have significant consequences for the quality and reliability of the audit. Additionally, certain control, such as password strength or configuration validation, are not well suited for manual verification, further increasing the risk of inconsistency and oversight.

Terma addresses these challenges through an in-house developed, fully secure Integrated Accreditation Platform that automates a substantial portion of the audit and assessment activities. The platform accelerates assessment timelines while ensuring consistent, high-quality results. It can be operated by either Terma or the customer and provides a structured, repeatable approach that supports both initial accreditation and ongoing re-accreditation efforts.