OMB readies more security guidance

Defense Authorization Act

The Office of Management and Budget is planning to release more specific guidance on what agencies should include in their reports under the Government Information Security Reform Act.

Enacted in October as part of the 2001 Defense Authorization Act, GISRA outlines the information security management requirements for agencies, including an annual self-assessment and an independent assessment by each agency's inspector general.

Under GISRA, agencies must use these assessments to improve their security programs and practices. Reports on the assessments must also be turned over to OMB, which will then provide a summary report for Congress.

OMB issued its first guidance in January, outlining the roles of officials within agencies and suggesting that program officers and IGs coordinate their assessments to avoid duplication of effort and to ensure consistency.

The new guidance will provide more details about what agencies and IGs need to include in their reports to OMB, said Glenn Schlarman, a security policy analyst at OMB's Office of Information and Regulatory Affairs.

The guidance probably will direct program officials and IGs to providea two- to three-page executive summary because OMB will be going through more than 40 reports to summarize for Congress, and "we're going to be very busy," Schlarman said.

Featured

  • Government Innovation Awards
    Government Innovation Awards - https://governmentinnovationawards.com

    Congratulations to the 2020 Rising Stars

    These early-career leaders already are having an outsized impact on government IT.

  • Cybersecurity
    cybersecurity (Rawpixel/Shutterstock.com)

    CMMC clears key regulatory hurdle

    The White House approved an interim rule to mandate defense contractors prove they adhere to existing cybersecurity standards from the National Institute of Standards and Technology.

Stay Connected