Risky Business

CIO Council efforts to help agency managers secure their systems against

threats that compromise data and services include these programs:

* By the end of next year, produce guidelines to help agencies get a better

handle on risk management.

* Develop benchmarks to help agencies determine what security is adequate

for electronic services. The benchmarks will cover three primary areas:

Web-based information services, financial trans-actions with the public

and government/ industry procurement.

* Finalize a letter this month that asks agency CIOs to formally work

with the Federal Computer Incident Response Capability to exchange warning

and vulnerability information.

* At the end of this month, publish the first version of an information

tech-nology security assessment framework to help agencies gauge their progress.