The NASA Headquarters Information Assurance Office is responsible for the following with respect to the unclassified information and information systems:

• Establish information security policies and issue instructions, memoranda, and bulletins for the Agency to protect unclassified information.
  
  
• Establish an information security compliance and "Best Practices" review program designed to ensure that all NASA information systems used to process unclassified information are in compliance with NASA policy and federal guidelines.
  
  
• Conduct periodic assessments of system security certifications to assure agency wide consistency and compliance with the guidelines for security certification and accreditation established by the National Institutes of Standards and Technology in NIST SP800-37 "Guideline for the Security Certification and Accreditation of Federal Information Systems"
  
  
• Oversee periodic independent assessment of the security control tests and evaluations results to assure agency wide consistency and compliance with the guidelines for security control testing and evaluation established by the National Institutes of Standards and Technology.
  
  
• Establish a root cause analysis program for computer security incidents involving unclassified IT systems to ensure that the root causes of IT security weaknesses are being addressed.