The Department of Defense information security process: A study of change acceptance and past-performance-based outsourcing.

摘要

Subchapter III of Chapter 35 of Title 44, United States Code, Federal Information Security Management Act of 2002; Department of Defense (DoD) Directive 8500.01E, Information Assurance, October 24, 2002; DoD Directive 8100.1, Global Information Grid Overarching Policy, September 19, 2002; and DoD Instruction 8500.2, Information Assurance Implementation, February 6, 2003, are drivers for the current DoD Information Assurance Certification and Accreditation Process (DIACAP). The DIACAP was introduced to the military on November 28, 2007. DIACAP replaced the DoD Information Technology Security Certification and Accreditation Process. Information security guidance is overarching in nature and is subject to specific mission, system, and operational requirements. By its very nature, information security is designed to protect access to, prevent attack from, and ensure operations against malicious intent. Government managers who maintain information systems might find it difficult to accept change from a mission-driven information system to a secure mission-driven operational system as security configurations can adversely affect operations if not implemented properly. One implementation option for the DoD information security process is to outsource to information security professionals who specialize in accomplishing the DIACAP.