Independent Evaluation of NRC’s Implementation of the Federal Information Security Modernization Act of 2014 For Fiscal Year 2019
Report Information
Recommendations
Use the fully defined ISA to conduct an organization-wide security and privacy risk assessment.
Use the fully defined ISA to formally define enterprise, business process, and information system level risk tolerance and appetite levels necessary for prioritizing and guiding risk management decisions.
Use the fully defined ISA to update the list of high value assets by considering risks from the supporting business functions and mission impacts.
Use the fully defined ISA to assess enterprise, business process, and information system level risks.
Use the fully defined ISA to identify and update NRC risk
management policies, procedures, and strategy.