and guidelines which provide the foundation for strong information security programs at agencies. NIST performs its statutory responsibilities through the Computer Security Division of the Information Technology Laboratory. NIST develops standards, metrics, tests, and validation programs to promote, measure, and validate the security in information systems and services. NIST hosts the following: FISMA implementation project Information Security Automation Program (ISAP) National Vulnerability Database (NVD) – the U.S. government content repository for ISAP and Security Content Automation Protocol (SCAP). NVD is the U.S. government repository of standards based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance (e.g., FISMA) Compliance framework defined by FISMA and supporting standards FISMA defines a framework for managing information security that must be followed for all information systems used or operated by a U.S. federal government agency in the executive or legislative branches, or by a contractor or other organization on behalf of a federal agency in those branches. This framework is further defined by the standards and guidelines developed by NIST. Inventory of information systems FISMA requires that agencies have an information systems inventory in place. According to FISMA, the head of each agency shall develop and maintain an inventory of major information systems (including major national security systems) operated by or under the control of such agency The identification of information systems in an inventory under this subsection shall include an identification of the interfaces between each such system and all other systems or networks, including those not operated by or under the control of the agency. The first step is to determine what constitutes the "information system" in question. There is not a direct mapping of computers to an information system; rather, an information system may be a collection of individual computers put to a common purpose and managed by the same system owner. NIST SP 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems provides guidance on determining system boundaries. Categorize information and information systems according to risk level All information and information systems should be categorized based on the objectives of providing appropriate levels of information security according to a range of risk levels The first mandatory security standard required by the FISMA legislation, FIPS 199 "Standards for Security Categorization of Federal Information and Information Systems" provides the definitions of security categories. The guidelines are provided by NIST SP 800-60 "Guide for Mapping