Deficiencies in federal information security are a growing concern. In February 1997, GAO included information security in its list of government program areas at high risk for waste, fraud, abuse, and mismanagement. Although many factors contribute to these weaknesses, audits by GAO and Inspectors General have found that an underlying cause is poor management of security programs. This guide, which is intended to help federal officials strengthen their security programs, examines organizations with superior security programs and identifies management practices that could benefit federal agencies.

This guide is intended to define the actions federal officials can take to better manage the information resources upon which the U.S. is increasingly reliant. Sections include: federal information security is a growing concern; leading organizations apply fundamental risk management principles; establish a central management focal point; implement appropriate policies and related controls; promote awareness; monitor and evaluate policy and control effectiveness; guides on information technology management; generally accepted principles and practices for securing information technology systems.

AIMD-98-68 Executive Guide: Information Security Management--Learning From Leading Organizations

Virtually all of the executive agencies have appointed Chief Information Officers (CIO), & many have taken positive steps toward the implementation of information management (IM) processes specified by law. To reap the full benefits of IM reform, Federal agencies must utilize the full potential of CIOs as IM leaders & participants in the development of agency strategic plans & policies. The CIOs must meet the challenge of building credible IM organizations, & developing & organizing IM capabilities to meet agency mission needs. This guide will assist Fed. agencies in maximizing the success of CIOs. Offers concrete suggestions on what agency executives can do to ensure the effectiveness of their CIO organizations.