Introduction

There are 23 ICAM-related metrics in the FY17 FISMA Metrics, including several new metrics that have not been collected previously. For example:

• Average time (in days) to revoke role-based privileges from contractors once it has been determined they are no longer needed
• Number of privileged network users that had their privileges reviewed at least once in the past twelve months

We believe these metrics will result in actionable information to prioritize and guide decisions around resource utilization to assure ICAM Program effectiveness. The ultimate goal of these metrics is to enable your agency to ensure the right people have the right access to the right data at the right time. ICAM program advancement is an incremental process and unique to each agency’s mission and business needs.

The GSA FICAM Program, has worked with DHS and OMB, to develop practical guidance to help agencies collect the data for the ICAM-specific FISMA metrics. This guidance should provide agencies with support to logically navigate and interpret the metrics to decrease reporting time and increase usability and understanding. We hope that senior leadership will have a better “apples-to-apples” comparison across agencies if all agencies have a clearer understanding of what the metrics represent and how to collect and report them. We’ve done the best we can to clarify how these metrics can be collected.