Guide to Information Technology Security Services

Published

October 13, 2003

Author(s)

Timothy Grance, Joan Hash, Marc Stevens, K O'Neal, N Bartol

Abstract

Organizations frequently must evaluate and select a variety of information technology (IT) security services in order to maintain and improve their overall IT security program and enterprise architecture. IT security services, which range from security policy development to intrusion detection support, may be offered by an IT group internal to an organization, or by a growing group of vendors. Organizations can benefit when choices among services and service providers stimulate competition and bring innovation to the marketplace. However, it is difficult and challenging to determine service provider capabilities, measure service reliability and navigate the many complexities involved in security service agreements. Individuals who are responsible for selecting, implementing, and managing IT security services for an organization must carefully evaluate their options before selecting resources that will be entrusted to meet their particular IT security program requirements. The factors to be considered when selecting, implementing, and managing IT security services include: the type of service arrangement; service provider qualifications, operational requirements and capabilities, experience, and viability; trustworthiness of service provider employees; and the service provider s capability to deliver adequate protection for the organization systems, applications, and information. These considerations will apply (to varying degrees) to every service depending on the size, type, complexity, cost, and criticality of the services being considered and the specific needs of the organization implementing or contracting for the services.

Citation

Special Publication (NIST SP) - 800-35

Report Number

800-35

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Download Paper

Local Download

Citation

Grance, T. , Hash, J. , Stevens, M. , O'Neal, K. and Bartol, N. (2003), Guide to Information Technology Security Services, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=906567 (Accessed April 25, 2024)