The act requires federal  agencies to protect and maintain the confidentiality, integrity, and  availability of their information and information systems. NIAP Offers Benefits for Use in National Security Systems, but Process Faces Considerable Challenges

While the NIAP evaluation process offers benefits to national security  systems, its effectiveness has not been measured or documented, and  considerable challenges to acquiring and using NIAP-evaluated products  exist. NIAP Evaluation Process Offers Benefits

NIAP process participants—vendors, laboratories, federal agencies, and  NIAP officials—identified benefits to using the process for use in national  security systems, including   independent testing and evaluation of IT products and accreditation of  the performing laboratories, which can give agencies confidence that  the products will perform as claimed;  international recognition of evaluated products, which provides  agencies broader product selection and reduces vendor burden;   discovery of software flaws in product security features and functions,  which can cause vendors to fix them; and  improvements to vendor development processes, which help to improve  the overall quality of current and future products. Collectively, these challenges hinder the effective use of the NIAP  evaluation process by vendors and agencies. Expanding NIAP Requirement to Non- national Security Systems May Yield Many of the Same Benefits and Challenges and Could Exacerbate Resource Constraints

While the National Security Telecommunications and Information Systems  Security Policy Number 11 already allows agencies with non-national  security systems to acquire NIAP-evaluated products, expanding the policy  to mandate that such systems acquire NIAP-evaluated products may yield  many of the same benefits and challenges experienced by current process  participants, and could further exacerbate resources. For example, one  identified benefit for national security systems—independent testing and  evaluation of IT products—gives agencies confidence that validated  features of a product, whether acquired for national or non-national  security systems, will perform as claimed by the vendor. Moreover, agencies seeking information assurance for their non-national  security systems, but who do not acquire NIAP-evaluated products, have  guidance and standards available to them. These challenges include the difficulty in matching agencies’  needs with the availability of NIAP-evaluated products, vendors’ lack of  awareness regarding the evaluation process, a reduction in the number of  validators to certify products, and difficulty in measuring and documenting  the effectiveness of the NIAP process. Objectives, Scope, and Methodology

Our objectives were to identify (1) the governmentwide benefits and  challenges of the National Information Assurance Partnership (NIAP)  evaluation process; and (2) the potential benefits and challenges of  expanding the requirement of NIAP to non-national security systems,  including sensitive but unclassified systems.
Why GAO Did This Study

In 1997, the National Security Agency and the National Institute of Standards and Technology formed the National Information Assurance Partnership (NIAP) to boost federal agencies' and consumers' confidence in information security products manufactured by vendors. To facilitate this goal, NIAP developed a national program that requires accredited laboratories to independently evaluate and validate the security of these products for use in national security systems. These systems are those under control of the U.S. government that contain classified information or involve intelligence activities. GAO was asked to identify (1) the governmentwide benefits and challenges of the NIAP evaluation process on national security systems, and (2) the potential benefits and challenges of expanding the requirement of NIAP to non-national security systems, including sensitive but unclassified systems.

What GAO Found

While NIAP process participants--vendors, laboratories, and federal agencies--indicated that the process offers benefits for use in national security systems, its effectiveness has not been measured or documented, and considerable challenges to acquiring and using NIAP-evaluated products exist. Specific benefits included independent testing and evaluation of products and accreditation of the performing laboratories, the discovery and correction of product flaws, and improvements to vendor development processes. However, process participants also face several challenges, including difficulty in matching agencies' needs with the availability of NIAP-evaluated products, vendors' lack of awareness regarding the evaluation process, and a lack of performance measures and difficulty in documenting the effectiveness of the NIAP evaluation process. Collectively, these challenges hinder the effective use of the NIAP evaluation process by vendors and agencies. Expanding the requirement of the NIAP evaluation process to non-national security systems is likely to yield similar benefits and challenges as those experienced by current process participants. For example, a current benefit--independent testing and evaluation of IT products--gives agencies confidence that validated features of a product will perform as claimed by the vendor. However, federal policy already allows agencies with non-national security systems to consider acquiring NIAP-evaluated products for those systems, and requiring that they do so may further exacerbate current resource constraints related to the evaluation and validation of products. In the absence of such a requirement, agencies seeking information assurance (measures that defend and protect information and information systems by ensuring their confidentiality, integrity, authenticity, availability, and utility) for their non-national security systems have other federal guidance and standards available to them.