How should NSTISSP #11 be viewed?
NSTISSP #11 should be viewed as a tool for evaluating the security functionality provided by COTS IA and IA-enabled IT products at various robustness levels. A comprehensive risk management program must be considered from the outset in the design, acquisition and operation of all Information Technology (IT) systems. During the initial design phase of any information system, security considerations must be included. However, compliance with the policy in its most simplistic form (i.e., feel comfortable that a properly evaluated product has been acquired), should not be viewed as an “end result” IA solution in and by itself. The use of properly evaluated products certainly contributes toward the security and assurance of the overall system where they are employed and should be an important factor in IT procurement decisions. From an overall security perspective, however a properly evaluated product is only a part of the security solution. Other complementary controls are needed including
