Summary of the Independent Evaluation Pursuant to the
Government Information Security Reform Act Fiscal Year 2001
Sensitive But Unclassified Systems

Report No. 02-18
April 2002
Office of the Inspector General

EXECUTIVE SUMMARY

INTRODUCTION

FINDINGS

1. MANAGEMENT CONTROLS
   Security Policies and Procedures
   Authorization of Software Changes
   Risk Assessment Reporting

2. OPERATIONAL CONTROLS
   Contingency Planning
   System Backup Procedures
   System Configuration

3. TECHNICAL CONTROLS
   Password Management
   Logon Management
   Account Integrity Management
   System Auditing Management

CONCLUSION

APPENDIX I - BACKGROUND

APPENDIX II - OBJECTIVE, SCOPE, AND METHODOLOGY

APPENDIX III - RECOMMENDATIONS

APPENDIX IV - VIEWS OF RESPONSIBLE OFFICIALS AND STATUS OF REPORT