Why is there a need for a national IA acquisition policy like NSTISSP #11?
The technology advances and threats of the past decade have drastically changed thinking and approaches to protecting national security systems and information. The U.S. Government has migrated from the exclusive use of Government Off-the-Shelf (GOTS) products to a mix of Commercial Off-the-Shelf (COTS) and GOTS products for the protection of information within our national security systems. The proliferation of COTS information assurance (IA) products such as firewalls and Intrusion Detection Systems, as well as IA-Enabled products such as operating systems and database management systems with security attributes, has provided the community of users with a multitude of security products to choose from. All of the products come with their own specific claims relative to the security robustness they provide. In this context, it is important that COTS IA and IA-enabled IT products acquired by the U.S. Government Departments and Agencies be subject to a standardized evaluation process tha
