Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Security Self-Assessment Guide for Information Technology Systems



Marianne M. Swanson, Elizabeth B. Lennon


This ITL Bulletin summarizes Special Publication (SP) 800-26, Security Self-Assessment Guide for Information Technology Systems. Adequate security of information and the systems that process it is a fundamental management responsibility. Agency officials must understand the current status of their information security program and controls in order to make informed judgments and investments that appropriately mitigate risks to an acceptable level.Self-assessments provide a method for agency officials to determine the current status of their information security programs and, where necessary, establish a target for improvement. This self-assessment guide utilizes an extensive questionnaire containing specific control objectives and techniques against which an unclassified system or group of interconnected systems can be tested and measured. The guide does not establish new security requirements. The control objectives and techniques are abstracted directly from long-standing requirements found in statute, policy, and guidance on security.
ITL Bulletin -


assessments, computers, control objectives, information technology, security controls, self-assessments


Swanson, M. and Lennon, E. (2001), Security Self-Assessment Guide for Information Technology Systems, ITL Bulletin, National Institute of Standards and Technology, Gaithersburg, MD, [online], (Accessed May 25, 2024)


If you have any questions about this publication or are having problems accessing it, please contact

Created September 5, 2001, Updated February 19, 2017