Appendix 3 - NARA Directive 804_Information Technology System Security.pdf

This document is a NARA (National Archives and Records Administration) directive on Information Technology (IT) Systems Security, specifically NARA 804, issued on April 4, 2007. The directive establishes policy and guidance for securing all electronic information collected or maintained by NARA, defining the role of IT security within the agency's overall enterprise architecture. Key objectives include implementing IT security standards, ensuring security management processes are integrated with strategic planning, protecting information systems and assets, and providing security protections commensurate with potential risks.

The directive outlines comprehensive responsibilities for various roles including the Chief Information Officer, Chief Information Security Officer, System Developers, and System Administrators. It references multiple external directives and standards such as the Federal Information Security Management Act (FISMA), Presidential Directives, OMB Issuances, and NIST publications. The document emphasizes a risk management approach, continuous monitoring of IT security controls, and a training and awareness program to ensure all personnel understand their security responsibilities. The directive applies to all NARA information systems and personnel, including employees, contractors, interns, and volunteers with access to NARA's information systems.