Question

1. Explain the difference between a General Support System, Major Application, and a Minor Application and explain how you determine the accreditation boundary?

Answer 1

A general support system is an interconnected set of information resources under the same direct management. A communications network is a general support system. They can have an impact level of low,medium,or high under FIPS 199. General support systems support major applications and minor applications.

Major applications are federal applications that, because of the information they store, process, or transmit, require special management oversight. A major applicatiion is expected under FIPS 199 to have an imoact level of moderate or high, as there are more critical systems. Major applications are systems that perform a clearly specified function, for which there are readily identifiable threats.

Applications which are not deemed major are minor application. Minor applications inherit most of their security controls from the General Support System , or occasionally , the Major Application if they are part of one. Minor applications can have an imapct rating of low or moderate, but if a minor application must implement the minimum security requirements required by the system.

With accreditation boundaries, you run the risk of having them be too large,makiing them too unwidely and overly complex, or too small, making them overly difficult to manage, and more expensive than necessary. The boundary for an IT system should include all resources that are under the same direct management control. Additionally, organizations should consider the following when determining if a resource belongs to the system: Does the resource generally sipport the same mission objectives, operating characteristics, and security requirements? Does the resource generally reside in the same operating environment?

There is no cut-and-dry formula: organizations have a lot of flexibility in deciding the boudaries for their systems. The organization must include all key participants in the discussion, form business requirements, to security needs, to program costs.