NIST publishers Information Technology Security risk management guideline. (News Briefs).

In fulfillment of NIST's statutory responsibilities to advise Federal agencies on IT security, NIST recently published two new security guidance documents. NIST Special Publication 800-30. Risk Management Guide for Information Technology Systems provides an overview of the risk management process, describes how it fits into the system development life cycle, and defines the roles of various personnel who support and use this process. It also describes a risk assessment methodology, the steps in conducting an information technology risk assessment, and a risk mitigation process. Additionally, it outlines some factors that lead to a successful risk management program.

NIST Special Publication 800-33, Underlying Technical Models for Information Technology Security, provides a description of the technical foundations, termed "models," that underlie secure information technology. The document provides, in a concise form, the models that should be considered in the design and development of technical security capabilities. These models encompass lessons learned, good practices, and specific technical considerations. The documents are available at http://csrc.nist.gov/publications/nistpubs/index.html.

CONTACT: Edward Roback, [phone]; [e-mail].