NIST Seeks Comments on Draft Federal IT Security Standard

August 8, 2005

The National Institute of Standards and Technology (NIST) released for public comment the draft of Federal Information Processing Standard (FIPS) Publication 200 - Minimum Security Requirements for Federal Information and Information Systems. The document is intended to help federal agencies improve their information technology security and comply with the Federal Information Security Management Act (FISMA) of 2002.

According to NIST, FISMA requires all federal agencies to develop, document and implement agency-wide information security programs and to provide security for the information and information systems that support the operations and assets of the agency.

The act called upon NIST to develop the standards and guidelines needed for successful FISMA compliance.

The draft FIPS Publication 200 is the third NIST publication of a three-part series for this purpose.

FIPS Publication 199 - Standards for Security Categorization of Federal Information and Information Systems, issued in February 2004, requires agencies to categorize their information and information systems as low-impact, moderate-impact or high-impact regarding confidentiality, integrity and availability.

NIST SP 800-53 - Recommended Security Controls for Federal Information Systems, issued in February 2005, provides guidance on selecting the appropriate controls for 17 key security focus areas.

According to NIST, FIPS Publication 200 provides:

1. A specification for minimum security requirements for federal information and information systems.
2. A standardized, risk-based approach (as described in FIPS Publication 199) for selecting security controls in a cost-effective manner.
3. Links to NIST Special Publication 800-53.

NIST invites public comments on the draft standard until 5 p.m. Eastern Daylight Time on Sept. 13, 2005.

The document may be downloaded at http://csrc.nist.gov/publications/drafts.html.

NIST SP 800-53 provides guidance on selecting security controls for information systems in key areas such as risk assessment, contingency planning, and identification and authentication.

A companion document, NIST SP 800-53A - Guide for Assessing the Security Controls in Federal Information Systems, was drafted to help agencies take the next step: assessing the effectiveness of security controls once they are in place.

NIST invites public comments on this draft guideline until 5 p.m. Eastern Daylight Time on Aug. 31, 2005.

NIST SP 800-53A, and instructions on how to submit comments on it, may be found at http://csrc.nist.gov/publications/drafts.html.

Source: The National Institute of Standards and Technology (NIST).