文档介绍：National State Auditors Association
and the
U. S. General Accounting Office
A Joint Initiative
Management Planning Guide for
Information Systems Security
Auditing
December 10, 2001
References to specific vendors, services, products, and Web
sites noted throughout this document are included as
examples of information available on information security.
Such references do not constitute a mendation or
endorsement. Readers should keep in mind that the
accuracy, timeliness, and value of Web site information can
vary widely and should take appropriate steps to verify any
Web-based information they intend to rely on.
December 10, 2001
On behalf of the U. S. General Accounting Office (GAO) and the National State Auditors Association
(NSAA), it is our pleasure to present this Management Planning Guide for Information Systems
Security Auditing.
The rapid and dramatic advances in information technology (IT) in recent years have without question
generated tremendous benefits. At the same time, however, they have created significant,
unprecedented risks to government operations. Computer security has, in turn, e much more
important as all levels of government utilize information systems security measures to avoid data
tampering, fraud, disruptions in critical operations, and inappropriate disclosure of sensitive
information. Such use puter security is essential in minimizing the risk of malicious attacks
from individuals and groups.
To be effective in ensuring accountability, auditors must be able to evaluate information systems
security and offer mendations for reducing security risks to an acceptable level. To do so, they
must possess the appropriate resources and skills.
This guide is intended to help anizations respond to this expanding use of IT and the
itant risks that flow from such pervasive use by governments. It applies to any evaluative
anization, regardless of size or current methodology. Directed primarily at executives