The NSA amended NSA/CSS Regulation 112-17 to ensure that vulnerability assessments are conducted after all reorganizations and that activities such as time and attendance, travel, overtime, cash management, and automated information systems are addressed by the IMC program.