Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Don't Let IT Decisions Send You To Prison: Page 2 of 2

Worried about your social security number, tax history or military record? How about military troop deployment information, nuclear information technology and cyber-terrorism? All Federal agencies and their contractors are subject to the Federal Information Security Management Act (FISMA) that was intended to increase computer and network security. This broad reaching tries to setup a framework to ensure that information within the government is protected, but too often can be a paper process and not result in true security.

Missing in FISMA is the definition of what systems, or boundaries, are covered under the Act and any definitive way to classify the sensitivity, especially in civilian agencies, of the data itself. Instead, the act uses a series of averages to determine the overall risk of compromised systems.

FISMA also mandates hardware and software inventory of the systems and major applications that reside within the defined boundaries of the system. This inventory includes a level of detail that focuses on hardware make and model numbers, software version numbers, patch levels, and functional description of the purpose of the system.

Aside from regulatory audits and meeting best practice guidelines, policy management has a big impact on IT. Organizations need to understand what regulations impact them and how they can translate regulatory requirements into practical IT requirements. Watch for our upcoming article on policy management in InformationWeek and our discussion of some software vendors that can help.