Independent Evaluation of NRC’s Implementation of the Federal Information Security Management Act (FISMA) for Fiscal Year 2012

Update all procedures, guides, and user manuals that provide guidance for maintaining system inventory records within NSICD [Nuclear Regulatory Commission System Information Control Database] to clearly define which organizations(s) are responsible for adding new system inventory records in NSICD.

Update the instructions included with the biannual inventory update to require system owners to notify the agency of any new systems that are not reflected in the data call.

Include all systems in NSICD, including all independent standalone hardware that has an NSICD system inventory number, in future biannual inventory update data calls.

Assign responsibility for ensuring each NRC remote location maintains a consolidated inventory of all the IT system components located in that location, associated rack diagrams are kept up-to-date, and the inventory meets NRC requirements.

Create a consolidated inventory that meets NRC requirements of all the IT system components located in each NRC remote location.