TABLE OF CONTENTS Determining Contract Requirements
Understanding Contract Pitfalls
Staffing Your Project
Adequately Understanding Customer Expectations
Understanding What You Should Expect
Case Study: Scoping Effort for Organization for Optimal Power Supply (OOPS)
Summary
Solutions Fast Track
Frequently Asked Questions
The National Security Agency (NSA) Information Security (INFOSEC) Assessment Methodology (IAM) is a detailed and systematic method for examining security vulnerabilities from an organizational perspective as opposed to a only a technical perspective. Often overlooked are the processes, procedures, documentation, and informal activities that directly impact an organization s overall security posture but that might not necessarily be technical in nature. The IAM was developed by experienced NSA and commercial INFOSEC assessors and has been in practice within the U.S. government since 1997. It was made available commercially in 2001.
NSA developed the IAM to give organizations that provide INFOSEC assessments a repeatable framework for conducting organizational types of assessments as well as provide assessment consumers appropriate information on what to look for in an assessment provider. The IAM is also intended to raise awareness of the need for organizational types of assessment versus the purely technical type of assessment. In addition to assisting the government and private sectors, an important result of supplying baseline standards for INFOSEC assessments is fostering a commitment to improve an organization s security posture.
As with any project, the first step is to identify a need; in this case, it s the need for an assessment. This identification can happen in two ways. An organization s leaders...
