New Standard AIms To Help Federal Agencies Secure Their NetworksNew Standard AIms To Help Federal Agencies Secure Their Networks

The Commerce Department has issued a new standard to help federal agencies secure their computer networks, introducing significant changes in how the government protects information.

The mandate includes standards to be used by non-national security agencies in categorizing information and IT systems, providing suitable levels of security according to a series of impact levels. Under the standard, agencies will assess the potential impact on their missions that would result from a security breach due to unauthorized disclosure or modification of information and denial of service.

Robert Dacey, director for IT security issues at the General Accounting Office, the investigative arm of Congress, says the new standards are significant because they establish minimum risk criteria throughout government. By having common standards throughout government, agencies will develop common tools, applications, and training. Also, officials can build the appropriate security into interfaces when linking systems from multiple agencies because they'll know each systems' risk levels. "You want to develop security management that's based on risk, and put the most security in systems with the highest risks," Dacey says.

Congress required the Commerce Department's National Institute of Standards and Technology to develop the standard, which officials characterize as a critical component of an agency's risk management program. NIST also is developing a companion standard that will specify minimum-security requirements for all federal information systems. Together, the Commerce Department says, these two standards will help ensure that appropriate, cost-effective security measures are put in place for each federal information system.

In a statement, Commerce Secretary Donald Evans said the new standard "will help agencies better handle security threats by providing better information and guidance to federal agencies so they can make sound decisions."