to determine the extent to which it is adequately addressing the
continuing problem of security flaws in commercial software products.
In 2005, the DHS CS&C NCSD contracted the Institute for Defense
Analyses (IDA) to undertake a major review of the NIAP, [77] and to