RiskManagementGuideforInformationTechnologySystemsRecommendationsoftheNationalInstituteofStandardsandTechnologyGaryStoneburner,AliceGoguen,andAlexisFeringaSpecialPublication800-30SP800-30PageiiCOMPUTERSECURITYComputerSecurityDivisionInformationTechnologyLaboratoryNationalInstituteofStandardsandTechnologyGaithersburg,MD20899-89301BoozAllenHamiltonInc.3190FairviewParkDriveFallsChurch,VA22042July2002U.S.DEPARTMENTOFCOMMERCEDonaldL.Evans,SecretaryTECHNOLOGYADMINISTRATIONPhillipJ.Bond,UnderSecretaryforTechnologyNATIONALINSTITUTEOFSTANDARDSANDTECHNOLOGYArdenL.Bement,Jr.,DirectorNISTSpecialPublication800-30RiskManagementGuideforInformationTechnologySystemsRecommendationsoftheNationalInstituteofStandardsandTechnologyGaryStoneburner,AliceGoguen1,andAlexisFeringa1SP800-30PageiiiReportsonComputerSystemsTechnologyTheInformationTechnologyLaboratory(ITL)attheNationalInstituteofStandardsandTechnologypromotestheU.S.economyandpublicwelfarebyprovidingtechnicalleadershipforthenation’smeasurementandstandardsinfrastructure.ITLdevelopstests,testmethods,referencedata,proof-of-conceptimplementations,andtechnicalanalysestoadvancethedevelopmentandproductiveuseofinformationtechnology.ITL’sresponsibilitiesincludethedevelopmentoftechnical,physical,administrative,andmanagementstandardsandguidelinesforthecost-effectivesecurityandprivacyofsensitiveunclassifiedinformationinfederalcomputersystems.TheSpecialPublication800-seriesreportsonITL’sresearch,guidance,andoutreacheffortsincomputersecurity,anditscollaborativeactivitieswithindustry,government,andacademicorganizations.NationalInstituteofStandardsandTechnologySpecialPublication800-30Natl.Inst.Stand.Technol.Spec.Publ.800-30,54pages(July2002)CODEN:NSPUE2Certaincommercialentities,equipment,ormaterialsmaybeidentifiedinthisdocumentinordertodescribeanexperimentalprocedureorconceptadequately.SuchidentificationisnotintendedtoimplyrecommendationorendorsementbytheNationalInstituteofStandardsandTechnology,norisitintendedtoimplythattheentities,materials,orequipmentarenecessarilythebestavailableforthepurpose.SP800-30PageivAcknowledgementsTheauthors,GaryStoneburner,fromNISTandAliceGoguenandAlexisFeringafromBoozAllenHamiltonwishtoexpresstheirthankstotheircolleaguesatbothorganizationswhorevieweddraftsofthisdocument.Inparticular,TimothyGrance,MarianneSwanson,andJoanHashfromNISTandDebraL.Banning,JeffreyConfer,RandallK.Ewell,andWaseemMamloukfromBoozAllenprovidedvaluableinsightsthatcontributedsubstantiallytothetechnicalcontentofthisdocument.Moreover,wegratefullyacknowledgeandappreciatethemanycommentsfromthepublicandprivatesectorswhosethoughtfulandconstructivecommentsimprovedthequalityandutilityofthispublication.SP800-30PageivTABLEOFCONTENTS1.INTRODUCTION..............................................................................................................................................11.1AUTHORITY.................................................................................................................................................11.2PURPOSE......................................................................................................................................................11.3OBJECTIVE..................................................................................................................................................21.4TA...
优质VIP
