Welcome to the National Security Agency (NSA) Information Assurance Methodology (IAM). In 1998, the NSA IAM was developed to meet the demand for information security (INFOSEC) assessments a demand that was increasing due to Presidential Decision Directive 63 (PDD-63) while at the same time NSA was downsizing. NSA sought a way to maximize its resources to assist as many customers as possible. Due to Public Law 100-235, NSA was responsible for providing security guidance to all federal government classified computer systems. PDD-63 expanded this requirement to include direct support for all federal agency classified systems.

The solution was for NSA to compile a list of organizations that could perform the same service (in other words, conduct assessments the same way NSA does). This list would be provided by NSA and used by any INFOSEC assessment customers to aid them in choosing a provider organization. This system allows NSA to focus on the highest-priority customers while still partially assisting all the customers that request help. To enable this system, NSA created the INFOSEC Assessment and Rating Program (IATRP). NSA quickly realized that this system would not only provide valuable information to consumers it would also provide a vehicle for standardization of INFOSEC assessments.

The IATRP is broken into two parts: training and rating. The first part, training, is the dissemination of the standard, a three-phase process that is explained in depth in this book.

To make this concept even simpler to understand, consider the process as similar to a process improvement scenario. Information...