Much of NIST research depends upon computer models, computer data, and other electronic information. With the increasing reliance on computing technologies, including the use of the Internet and its related information dissemination techniques, the potential loss, compromise, and misuse of NIST data and facilities has grown tremendously. This subchapter outlines computer security measures designed to help reduce the risk associated with loss of computing resources, services, or data integrity. It is NIST policy to comply fully with all federal statutes and Department of Commerce regulations on computer security. The NIST Computer Security Officer and the computer security personnel in the central facilities are available to consult with staff on computer and information security.
System administrators are accountable for systems under their control.
The users are also responsible for helping to maintain security. All new system purchases and development of new software must have a risk assessment to determine the needed computer security that supplies the correct level of protection at a cost commensurate with the risk and potential losses. Security controls are based on sound administrative and technical judgement, the value of the resources being protected, and potential risk. These risk assessments must be reviewed and updated at least once every three years. Physical Security - The necessary facilities and procedures must be implemented for physical security of information resources.