Page History

...

As part of the implementation step, you may need to update your application’s design requirements to account for new or modified security requirements identified in Step 2. You may also need to implement or develop specific tools to satisfy required controls.  If the cost of developing or implementing a new security control is impractical or if it is not cost effective when compared to the potential risk of not implementing the control, you can apply for a security waiver to the NIH chief information security officer (CISO). You should discuss any waiver requests with the NCI ISSO NCIIRM@mail.nih.gov first first before submitting the request to determine whether it is likely to be approved, and to help appropriately document the waiver.

...