I think the jury is out on that.

If I just knew those five things, I'd be better off than I am today. Paper-based processes don't get you to those five things.

That process could replace an inordinate amount of paper that is generated right now on certification and accreditation.

You really have to ask yourself what has five years of FISMA given to us?

When the annual FISMA grades are released -- which could be imminently -- you have to ask yourself, what do those grades really mean? The high grades could mean a lot of compliance, but not a lot of security. The low grades could mean that there's plenty of security in place, but it just wasn't verified on paper properly.

High grades could mean a lot of compliance but not necessarily a lot of security.