Agencies Need to Develop and Implement Adequate Policies for Periodic Testing

GuidanceGovernment Accountability Office (GAO)Information Security

Why GAO Did This Study
Agencies rely extensively on computerized information systems and electronic data to carry out their missions. To ensure the security of the information and information systems that support critical operations and infrastructure, federal law and policy require agencies to periodically test and evaluate the effectiveness of their information security controls at least annually.

GAO was asked to evaluate the extent to which agencies have adequately designed and effectively implemented policies for testing and evaluating their information security controls.

> Read entire regulation (log in required - registration is free)