Based on a review of the [variable: Covered application(s) or system(s)] security plan and the security requirements of the [variable: Covered application(s) or system(s)], this application or system cannot be accredited at this time. The reasons for deferring such accreditation include:

• [_] An analysis of threats, vulnerabilities, and safeguards has not been performed within the last [variable: time period] years

• [_] No documented security specifications exist

• [_] Documented testing of security specifications has not been performed within the last [variable: time period] years

• [_] Major vulnerabilities exist (specify)

• [_] Personnel screening has not been performed

• [_] Security awareness training has not been performed

• [_] Other (specify)

I authorize initiation of the following correction actions, to be completed within the next calendar year:

• [variable: Required corrective action 1]
• [variable: Required corrective action 2]
• [variable: …]

Signature:

____________________________________________________________

• [variable: Title of signing officer/director/manager]

• [variable: Covered Organization]

• [variable: Date]

References

Related Template(s)

• System Security Certification/Accreditation, Annual (Form)

Content Model(s)

• Federal Agency Security Practices, National Institute of Standards and Technology (NIST)