Government Information Security Reform Act Implementation PDF Download

Public Law 106-398, Government Information Security Reform, title X, subtitle G of the Floyd D. Spence National Defense Authorization Act for FY 2001, October 30, 2000, requires that each agency obtain an independent assessment of its security posture. The Inspector General of each agency is required to evaluate the agency security posture based on a review of an independently selected subset of information systems. The DoD uses information technology for thousands of processes that are integral to support and operational functions. Mission-critical, mission-essential, and support-function processes, or applications, reside on computer systems throughout DoD. DoD selected a sample of 560 automated information systems from the almost 4,000 automated information systems in DoD. For those 560 systems, DoD developed a Government Information Security Reform Act collection matrix that was used to gather data on assessments of the effectiveness of DoD information assurance policies, procedures, and practices. DoD reported the aggregate results of the assessments for FY 2001 in GISR Report FY01: Government Information Security Reform Act, Report of the Department of Defense, October 2001. Of the 560 systems, the Office of the Inspector General of the Department of Defense; the Defense Information Systems Agency Inspector General; and Military Department Audit Agencies assessed a sample of 115 systems. This report is one in a series of Government Information Security Reform Act audits and is an assessment of the Noncombatant Evacuation Operations Tracking System.