1. What are the inherent problems with ISO 17799, and why hasn't the United States adopted it? What are the recommended alternatives?
2. What documents are available from the NIST Computer Resource Center, and how can they support the development of a security framework?