These observations are based on the body of work we have developed over the last several years and on our recent discussions with federal information security officers and other federal officials who are knowledgeable about federal information security practices.