NIST sets the standards (FIPS). Most programs for security guidelines seem to be descendants and ongoing implementations of HSPD-12. I believe the Office of t

NIST sets the standards (FIPS). Most programs for security guidelines seem to be descendants and ongoing implementations of HSPD-12. I believe the Office of the Inspector General would be in charge of auditing in some cases, but it's usually up to each individual agency.