Approval of Federal Information Processing Standards Publication 161-2, Electronic Data Interchange (EDI)

DEPARTMENT OF COMMERCE

National Institute of Standards and Technology

[Docket No. 950314073-6067-02]

RIN 0693-ZA07

Approval of Federal Information Processing Standards Publication

161-2, Electronic Data Interchange (EDI)

AGENCY: National Institute of Standards and Technology (NIST),

Commerce.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The purpose of this notice is to announce that the Secretary

of Commerce has approved a revision of Federal Information Processing

Standard (FIPS) 161-1, Electronic Data Interchange (EDI), which will be

published as FIPS Publication 161-2. This revision reflects changes in

the development of voluntary industry standards for Electronic Data

Interchange (EDI), including the planned alignment of the X12 and UN/

EDIFACT families of standards, and provides updated guidance to Federal

agencies in the selection of EDI standards. The revision adopts the HL7

standards for EDI as an alternative for certain healthcare

applications. It also establishes a Federal EDI Standards Management

Committee to harmonize the development of EDI transaction set and

message standards among Federal agencies, and the setting of

governmentwide implementation conventions for EDI applications used by

Federal agencies. FIPS PUB 161-2 supersedes FIPS PUB 161-1 in its

entirety. The announcement section of FIPS 161-2 is provided in this

notice.

On April 3, 1995, notice was published in the Federal Register (60

FR 16854-16857) that a revision of Federal Information Processing

Standard (FIPS) 161-1, Electronic Data Interchange (EDI), was being

proposed for Federal use.

The written comments submitted by interested parties and other

material available to the Department relevant to this standard were

reviewed by NIST. On the basis of this review, NIST recommended that

the Secretary approve the revised standard as Federal Information

Processing Standards Publication (FIPS PUB) 161-2, and prepared a

detailed justification document for the Secretary's review in support

of that recommendation.

The detailed justification document which was presented to the

Secretary, and which includes an analysis of the written comments

received, is part of the public record and is available for inspection

and copying in the Department's Central Reference and Records

Inspection Facility, Room 6020, Herbert C. Hoover Building, 14th Street

between Pennsylvania and Constitution Avenues NW., Washington, DC

20230.

EFFECTIVE DATE: FIPS PUB 161 was effective September 30, 1991.

ADDRESSES: Interested parties may purchase copies of the announcement

section of FIPS 161-2 from the National Technical Information Service

(NTIS). Specific ordering information from NTIS for this standard is

set out in the Where to Obtain Copies Section of the standard.

Documents defining both the X12 and EDIFACT families of standards

are available from DISA, Inc. or from its named contractor. DISA, Inc.

serves as the secretariat for Accredited Standards Committee (ASC) X12

and the Pan American EDIFACT Board (PAEB) and its address and phone

number are as follows: Data Interchange Standards Association, Inc.

(DISA, Inc.), 1800 Diagonal Road, Suite 200, Alexandria, VA 22314-2852.

Telephone (703) 548-7005.

HL7 documents are available from: Health Level Seven, Inc., 3300

Washtenaw Avenue, Suite 227, Ann Arbor, MI 48104. Telephone (313) 677-

7777.

FOR FURTHER INFORMATION CONTACT: Mr. Roy Saltman, telephone (301) 975-

3376, National Institute of Standards and Technology, Gaithersburg, MD

20899.

Dated: May 16, 1996.

Samuel Kramer,

Associate Director.

Federal Information Processing Standards Publication 161-2, 1996 Month

Day, Announcing the Standard for Electronic Data Interchange (EDI)

Federal Information Processing Standards Publications (FIPS PUBS)

are issued by the National Institute of Standards and Technology (NIST)

after approval by the Secretary of Commerce pursuant to Section 5131 of

the Information Technology Management

[[Page 25628]]

Reform Act of 1996 and the Computer Security Act of 1987, Public Law

104-106.

1. Name of Standard. Electronic Data Interchange (EDI) (FIPS PUB

161-2).

2. Category of Standard. Electronic Data Interchange.

3. Explanation.

3.1. Definition and Use of EDI. EDI is the computer-to-computer

interchange of strictly formatted messages that represent documents

other than monetary instruments. EDI implies a sequence of messages

between two parties, either of whom may serve as originator or

recipient. The formatted data representing the documents may be

transmitted from originator to recipient via telecommunications or

physically transported on electronic storage media.

In EDI, the usual processing of received messages is by computer

only. Human intervention in the processing of a received message is

typically intended only for error conditions, for quality review, and

for special situations. For example, the transmission of binary or

textual data is not EDI as defined here unless the data are treated as

one or more data elements of an EDI message and are not normally

intended for human interpretation as part of on-line data processing.

An example of EDI is a set of interchanges between a buyer and a

seller. Messages from buyer to seller could include, for example,

request for quotation (RFQ), purchase order, receiving advice and

payment advice; messages from seller to buyer could include, similarly,

bid in response to RFQ, purchase order acknowledgment, shipping notice

and invoice. These messages may simply provide information, e.g.,

receiving advice or shipping notice, or they may include data that may

be interpreted as a legally binding obligation, e.g., bid in response

to RFQ or purchase order.

EDI is being used also for an increasingly diverse set of concerns,

for example, for interchanges between healthcare providers and

insurers, for travel and hotel bookings, for education administration,

and for government regulatory, statistical and tax reporting.

3.2. Standards Required for EDI. From the point of view of the

standards needed, EDI may be defined as an interchange between

computers of a sequence of standardized messages taken from a

predetermined set of message types. Each message is composed, according

to a standardized syntax, of a sequence of standardized data elements.

It is the standardization of message formats using a standard syntax,

and the standardization of data elements within the messages, that

makes possible the assembling, disassembling, and processing of the

messages by computer.

Implementation of EDI requires the use of a family of interrelated

standards. Standards are required for, at minimum: (a) the syntax used

to compose the messages and separate the various parts of a message,

(b) types and definitions of application data elements, most of

variable length, (c) the message types, defined by the identification

and sequence of data elements forming each message, and (d) the

definitions and sequence of control data elements in message headers

and trailers.

Additional standards may define: (e) a set of short sequences of

data elements called data segments, (f) the manner in which more than

one message may be included in a single transmission, and (g) the

manner of adding protective measures for integrity, confidentiality,

and authentication into transmitted messages.

3.3. Limited Coverage of this Standard. This FIPS covers only EDI.

It does not cover other forms of electronic interchange, for example,

systems of interchange that do not consist of messages taken from a

predetermined set. Additionally, an interchange application including

only one or two predetermined message types using only fixed-length

data elements is excluded from coverage of this FIPS. This FIPS also is

not intended to cover transmissions from medical, laboratory, or

environment-sensing instrumentation.

3.4. The Long-Range Goal for EDI Standards. There are several

different EDI standards in use today, but the achievement of a single

universally-used family of EDI standards is a long-range goal. A single

universally-used family of standards would make use of EDI more

efficient and minimize aggregate costs of use. Specifically, it would

(a) minimize needs for training of personnel in use and maintenance of

EDI standards, (b) eliminate duplication of functionality and the costs

of achieving that duplication now existing in different systems of

standards, (c) minimize requirements for different kinds of translation

software, and (d) allow for a universal set of data elements that would

ease the flow of data among different but interconnected applications,

and thereby maximize useful information interchange.

This FIPS PUB recognizes the reality that some families of EDI

standards were developed to provide solutions to immediate needs, and

that inclusion of the goal of universality in their development would

have unacceptably delayed their availability. However, a future is

envisioned in which the benefits of universality outweigh the sunk

costs in specialized solutions, leading first to cooperation among

standards developers, then to harmonization of standards, and

eventually to a single universally accepted family of EDI standards.

3.5. Adoption of Specific Families of Standards. This FIPS PUB

adopts, with specific conditions specified below, the families of EDI

standards known as X12, UN/EDIFACT and HL7. This FIPS PUB does not

mandate the implementation of EDI systems within the Federal

Government; rather it requires the use of the identified families of

standards with specified constraints when Federal departments or

agencies implement EDI systems.

The UN/EDIFACT standards may be used for any application, domestic

or international. The X12 standards may be used for any domestic

application. The HL7 standards are adopted as an alternative for

certain healthcare applications, specifically for transmission of

patient records and of clinical, epidemiological, and regulatory data.

HL7 standards are not to be used for healthcare insurance

administrative applications, such as for enrollments, claims, and claim

payments, or for any aspect of the Government procurement cycle, such

as for registration of vendors, RFQ, purchase order, shipping notice,

or payment advice.

The cross-use of data elements is encouraged. A data element

received through one system of EDI standards, or through a non-EDI

interchange, may be re-transmitted as a data element in any of the

approved systems of EDI standards.

The adopted standards were developed by the following

organizations: the X12 standards by Accredited Standards Committee X12

on Electronic Data Interchange (ASC X12), accredited by the American

National Standards Institute (ANSI); the HL7 standards by Health Level

Seven, Inc., an ANSI-accredited standards developer; and the UN/EDIFACT

standards by the United Nations (UN) Economic Commission for Europe--

Working Party (Four) on Facilitation of International Trade Procedures

(UN/ECE/WP.4). Technical input from the United States in the

development of UN/EDIFACT at the UN is through the Pan American EDIFACT

Board (PAEB). The PAEB is separate from ASC X12, and it serves as the

coordinating body for national standards organizations of North,

Central, and South America.

3.6. Status of this FIPS PUB Revision. FIPS PUB 161-2 supersedes

FIPS PUB 161-1 in its entirety. FIPS PUB 161-2

[[Page 25629]]

contains editorial changes, updated references to documents and

organizations, and new guidance to agencies on the selection of

national and international standards and implementation conventions.

This guidance is based on recent voluntary industry standards

activities and on the Federal Government initiative that commenced with

the Presidential Memorandum of October 26, 1993 entitled ``Streamlining

Procurement Through Electronic Commerce.''

4. Approving Authority. Secretary of Commerce.

5. Maintenance Agency. U.S. Department of Commerce, National

Institute of Standards and Technology (NIST), Computer Systems

Laboratory.

6. Cross Index and Related Documents.

6.1. Cross Index.

--FIPS PUB 146-2, Profiles for Open Systems Internetworking

Technologies, May 1995.

6.2. Related Documents.

--ASC X12W/95-137, The ASC X12 Plan for Technical Migration to and

Administrative Alignment With UN/EDIFACT (amended), 5/8/95.

--NIST Special Publication 500-224, Stable Implementation Agreements

for Open System Environment, Version 8, Edition 1, 12/94.

--NIST Special Publication 800-9, Good Security Practices for

Electronic Commerce, Including Electronic Data Interchange, 12/93/.

--Office of Management and Budget (OMB) Circular A-119 (revised),

Federal Participation in the Development and Use of Voluntary

Standards, 10/93.

--UN/ECE/WP.4--Recommendation No. 25 on the Use of the UN/EDIFACT

Standard, 9/95.

6.3. Sources of Documents. For the source of cited NIST

publications, including FIPS PUBS, see Section 13. For the source of

X12, UN/EDIFACT and HL7 documents, see Subsection 10.1.

7. Objectives. The primary objectives of this standard are:

a. to ease the interchange of data sent electronically by use of

common standards that allow for automated message processing;

b. to promote the achievement of the benefits of EDI: reduced

paperwork, fewer transcription errors, faster response time for

procurement and customer needs, reduced inventory requirements, more

timely payment of vendors, and closer coordination of data being

processed on different computers for the same application;

c. to promote migration to a universally used family of EDI

standards, in order to further Government efficiency and to minimize

the cost of EDI implementation by preventing duplication of effort.

8. Applicability.

8.1. Conditions of application. EDI may be employed with any type

of operational data representable as a sequence of data elements that

is needed to be transmitted or received on a repetitive basis by a

Federal agency in the course of its activities. This standard is

applicable to the interchange of such data on a particular subject

within a Federal agency, or between a Federal agency and another

organization (which may be another Federal agency), if (1) The data are

to be transmitted electronically or physically transported between

computers using EDI, and (2) the necessary standard messages meeting

the data requirements of the Federal agency for the subject of the

interchange have been developed and approved, and are acceptable for

use under the conditions set forth in this FIPS PUB.

8.2. Subject Matter. Examples of applications (not necessarily the

subject of current standards) are:

a. vendor search and selection: price/sales catalogs, bids,

proposals, requests for quotations, notices of contract solicitation,

debarment data, trading partner profiles;

b. contract award: notices of award, purchase orders, purchase

order acknowledgments, purchase order changes;

c. product data: specifications, manufacturing instructions,

reports of test results, safety data;

d. shipping, forwarding, and receiving: shipping manifests, bills

of lading, shipping status reports, receiving reports;

e. customs: release information; manifest update;

f. payment information: invoices, remittance advices, payment

status inquiries, payment acknowledgments;

g. inventory control: stock level reports, resupply requests,

warehouse activity reports;

h. maintenance: service schedules and activity, warranty data;

i. tax-related data: tax information and filings;

j. insurance-related data: healthcare claim; mortgage insurance

application;

k. other government activities: communications license application;

court conviction record; hazardous material report; healthcare event

report.

9. Coordination of Federal EDI Standards Development and

Implementation.

9.1. Federal EDI Standards Management Coordinating Committee. There

is established a Federal EDI Standards Management Coordinating

Committee (FESMCC). The FESMCC is established to support the goal of a

single face for the Federal Government to its trading partners in the

use of EDI.

9.1.1. A responsibility of the FESMCC is the selection of

implementation conventions (ICs) to be used with EDI interchanges

between the Federal Government and its trading partners. EDI messages

(also called transaction sets) are approved by standards committees

with allowances for format options, in order to widen the applicability

of the standards to different uses. The purpose of ICs is to select

specific options in EDI standards so that interchanges are completely

determined in format in advance of use.

9.1.2. The basic functions of the FESMCC are:

(a) to adopt Government-wide ICs for use with EDI standards; the

goal is adoption of one IC for each functional application of a message

or transaction set within a given version/release of an EDI standard;

(b) to coordinate Federal agency participation in EDI standards

bodies, to assure adequate consideration of the Government's business

needs and to assure consistency of position; and

(c) to share EDI information among agencies regrading current or

planned implementations to avoid duplicate efforts and streamline the

process.

9.1.3. Voting membership in the FESMCC shall consist of, at

minimum, one representative from each participating Federal Executive

Branch department and independent agency using or planning to use EDI,

plus a representative from NIST. The FESMCC, under its charter and

operating rules (see Subsection 9.1.5), may add additional voting

representatives, including those from the other branches of the Federal

Government. The chair of the FESMCC shall be elected by its membership

and approved by OMB.

9.1.4. The FESMCC shall establish a secretariat in order to

maintain an official registry of approved and draft ICs, provide

controlled access to the registry including electronic remote access

capability, provide a point of contact for publicizing draft ICs and

receiving comments on them, provide a single point for submission of

work requests to standards bodies, and for related functions.

9.1.5. The FESMCC shall establish a charter and operating rules to

assist it in carrying out its identified functions.

9.2. Functional Work Groups.

9.2.1. The FESMCC may establish Functional Work Groups (FWGs) to

consider and recommend ICs in subject

[[Page 25630]]

areas. Examples of subject areas are procurement, finance, logistics,

and healthcare. Requirements for voting membership shall be established

by the FESMCC under its charter and operating rules. The voting members

shall elect a chair.

9.2.2. Each FWG shall recommend, to the full FESMCC, ICs that it

has developed and approved as meeting Federal Government and trading

partner business requirements. FWGs should consult with appropriate

industry groups in the development of ICs.

9.3. Agency Responsibilities.

9.3.1. Agencies shall register ICs that they are using with the

FESMCC secretariat.

9.3.2. Agencies using X12, UN/EDIFACT, or HL7 versions and releases

for which ICs have been established by the FESMCC shall adopt those

ICs. If an IC does not meet business needs, requirements shall be

submitted to the FESMCC. ICs shall be classified as Implementer's

Agreements pursuant to this FIPS PUB, but are not themselves FIPS PUBs.

9.3.3. Agencies using or planning to use EDI shall designate

representatives to the FESMCC and each relevant FWG.

9.3.4. Agencies requiring new EDI standards or changes to existing

EDI standards to meet their business needs shall submit their

requirements to the appropriate standards bodies and shall

simultaneously submit their requirements to the FESMCC and relevant

FWGs for coordination. Procedures and forms for submission of new

requirements through ASC X12 are specified in Standing Document (SD) 2,

Operations Manual, and SD6, Operations Manual for UN/EDIFACT Standards.

These manuals are available from Data Interchange Standards

Association, Inc. (DISA, Inc.). Procedures and forms for submission of

new requirements for UN/EDIFACT standards directly through the PAEB are

also available from DISA, Inc. HL7 operating procedures are specified

in its bylaws, available from Health Level Seven, Inc.

10. Specifications. Documents are available that define the X12,

UN/EDIFACT, and HL7 standards and provide information about the

standards organizations and their standards development processes.

Developments are continuing in each of these families of standards.

10.1. Source of Documents. Documents concerning both the X12 and

UN/EDIFACT families of standards are available from DISA, Inc. or from

its named contractor. DISA, Inc. serves as the secretariat for ASC X12

and the PAEB and may be contacted at:

Address: Data Interchange Standards Association, Inc., 1800 Diagonal

Road--Suite 200, Alexandria, VA 22314-2852,

Phone: (703) 548-7005

A list of available standards publications, as well as descriptive

material, prices and ordering procedures, may be found in the most

recent DISA, Inc. Publications Catalog.

HL7 documents are available from:

Address: Health Level Seven, Inc., 3300 Washtenaw Avenue, Suite 227,

Ann Arbor, MI 48104,

Phone: (313) 677-7777

10.2. ASC X12 Documents. X12 standards are published periodically

with revisions and updates, and standards included in a publication may

have one of two possible statuses:

(1) Draft Standards for Trial Use (DSTUs); these are fully approved

by ASC X12, and are typically published as ``releases'' at one-year

intervals. DSTU Version 3, Release 4, identified as 003040, was

published in 12/93; Version 3, Release 5, identified as 003050, was

published in 12/94. The next release, identified as 003060, is

available as of 1/96.

(2) American National Standards (ANSs); these are fully approved by

ASC X12 and by ANSI, and are typically published as ``versions'' at

intervals of three to five years. ANS Version 3, 3/92, is functionally

equivalent to DSTU Version 2, Release 4. It is expected that ANS

Version 4, planned for 1997, will be functionally equivalent to DSTU

Version 3, Release 7, identified as 003070.

10.3. UN/EDIFACT Documents. UN/EDIFACT standards are published

periodically with revisions and updates, and standards included in a

publication may have one of two possible statuses:

(1) Status 1, approved for trial use. A set of documents identified

as UN/EDIFACT Draft Messages and Directories, Version D.95A, was

published in 5/95. This document also included Status 2 messages. A new

set of standards, identified as D.95B and also including Status 2

messages, was approved in 9/95.

(2) Status 2, fully approved by UN/ECE/WP.4. The set of Status 2

documents may be referred to as the UN Trade Data Interchange Directory

(UNTDID). The last published version of Status 2 standards only, S.93A,

was issued in 5/94. See also Subsection 11.4 for additional information

on UN/EDIFACT Status 2.

10.4. HL7 Documents. HL7 standards are published as a single

volume. The current set is Version 2.2, published 12/94. A new Version

2.3 is planned for Fall 1996. HL7 standards also have one of two

possible statuses:

(1) HL7 standards, approved by the membership of HL7 but not yet

approved by ANSI.

(2) American National Standards (ANSs); these are fully approved by

HL7 and by ANSI.

11. Implementation.

11.1. Schedule for Adoption. FIPS PUB 161 was effective on

September 30, 1991. Federal agencies that are not using EDI for subject

matter for which X12, UN/EDIFACT, and HL7 standards have been approved

and issued shall utilize only those standards in EDI systems that they

procure or develop, subject to the qualifications of Subsections 3.5,

11.3, 11.4 and 11.5. Agencies that are using those standards shall

continue to do so, subject to the same qualifications. Agencies that

were using other standards on or after September 30, 1991 shall be

governed by Subsection 11.6.

11.2. Acceptance of UN/EDIFACT by ASC X12. In January 1995, ASC

X12, by a membership vote, approved the ASC X12 Plan for Technical

Migration to and Administrative Alignment With UN/EDIFACT. This plan

was modified at the February 1995 plenary meeting of ASC X12. Key

features of the modified Alignment Plan are:

(1) Draft standards based on X12-syntax or on UN/EDIFACT syntax may

be submitted by ASC X12 to ANSI for processing as ANSs.

(2) X12 Release 003070 shall form the basis of Version 4 of draft

proposed X12 American National Standards (ANSs).

(3) After the release of Version 4, ASC X12 shall continue for a

period of time, in accordance with the plan, to develop, maintain,

approve and publish X12-syntax transaction sets and supporting

documents.

(4) An ASC X12 ballot shall be conducted in 1998 to determine if

X12-syntax transaction set development should be terminated. If the

ballot for termination is not approved, a three-year repeating cycle

shall occur thereafter, until no new X12-syntax transaction sets are

being developed.

11.3. Selection of a Family of Standards.

11.3.1. Different families of EDI standards are distinct, although

performing similar functions; the existence of one does not preclude

the others. Equivalent functionality may be obtained in any system by

the addition, if required, of new or revised message formats and data

elements. Software that assembles and disassembles messages and

transaction sets, called translation software, is widely available,

often for more than one system in the

[[Page 25631]]

same package. In selecting a family of standards for domestic

applications, agencies should attempt to maximize Government economy

and efficiency and to minimize the costs imposed on U.S. businesses.

11.3.2. For any domestic application with a non-Government partner,

and for related intra-Government applications, selection of a family of

standards shall take into account the prevailing family used in the

industry of the interchange partners for the application. However, UN/

EDIFACT standards shall be employed for new or significantly upgraded

interchanges in the absence of demonstrably higher costs, or at the

request of interchange partners providing a significant fraction of

interchange traffic. Continued long-term use and maintenance of more

than one family of standards is unacceptably inefficient.

11.3.3. For international applications except as specified in

Subsection 11.3.4, planning for migration to the UN/EDIFACT family of

standards shall commence at this time if that family is not currently

being used. A timetable for conversion to UN/EDIFACT of existing

international implementations shall be set as applicable standards and

software become available. New or significantly upgraded interchanges

shall employ only standards using UN/EDIFACT.

11.3.4. The HL7 family of standards may be used for international

applications in the fields of public health and health regulatory

information, pursuant to agreements of international organizations

whose membership includes representation of national or multi-national

governmental health agencies. However, users shall coordinate with the

developers of UN/EDIFACT, in order to prevent duplication of effort,

provide for cross-use of data elements, and provide a path for

harmonization and eventual migration or coalescence.

11.4. Use of Category (1) Standards. UN/EDIFACT Status 1 standards,

X12 DSTUs, and HL7 standards not yet approved by ANSI are defined as

Category (1) standards. UN/EDIFACT Status 2 standards and ANSs

submitted by ASC X12 and HL7 are defined as Category (2) standards.

Federal agencies shall use only Category (1) or Category (2) standards

for EDI implementations. Industry practice is to use Category (1)

standards; these represent the latest consensus and are available

sooner than the corresponding full standards of Category (2).

Consequently, Category (1) standards are preferred, but not mandated at

this time. Note: There is a possibility that UN/EDIFACT Status 2

standards will be eliminated by UN/ECE/WP.4. In that case, UN/EDIFACT

Status 1 standards would be required when UN/EDIFACT is implemented.

11.5. Continued Use of Existing Approved Implementations. An

existing implementation of any version of an approved standard

specified in Subsections 3.5, 11.3 and 11.4 may continue to be used as

long as it continues to meet the business needs of the using agency and

its interchange partners. Significant upgrades of existing

implementations shall be to versions and releases for which ICs have

been approved by the FESMCC, if any are available.

11.6. Continued Use of Other EDI Standards. Under the initial issue

of this FIPS, Federal agencies using ``industry-specific'' EDI

standards were permitted to use those standards for five years from

September 30, 1991, i.e., until September 30, 1996. Agencies were

permitted to use ``industry-specific'' EDI standards beyond five years

only if no equivalent X12 or UN/EDIFACT standards, as appropriate, were

approved and issued by September 30, 1995. If an equivalent and

appropriate standard were issued after the latter date, agencies were

given one year to convert. These provisions remain in effect for all

application areas except health care.

For healthcare applications, agencies may use EDI standards other

than UN/EDIFACT, X12, or HL7 through September 30, 1997. Other

standards may be used beyond that date only if no functionally

equivalent standards that meet the conditions of use specified in

Subsections 3.5, 11.3 and 11.4 are approved and issued by September 30,

1996. If a Category (1) standard meeting business requirements and

allowable conditions of use is first issued after the latter date,

agencies have one year to convert following the issuance of the release

containing the implementable standard.

Requirements for submission of proposed new or revised standards

are specific in Subsection 9.3.4.

11.7. Security and Authentication. Agencies shall employ risk

management techniques to determine the appropriate mix of security

controls needed to protect specific data and systems. The selection of

controls shall take into account procedures required under applicable

laws and regulations.

Optional tools and techniques for implementation of security and

authentication may be provided by ASC X12 and UN/ECE/WP.4 for use in

connection with their respective families of standards. Agencies may

utilize these tools and techniques, and/or they may utilize other

methods in systems supporting the EDI data interchange. Methods and

procedures implemented shall be consistent with applicable FIPS PUBS

and guidance documents issued in NIST.

12. Waivers. Under certain exceptional circumstances, the heads of

Federal departments and agencies may approve waivers to Federal

Information Processing Standards (FIPS). The head of such agency may

redelegate such authority only to a senior official designated pursuant

to Section 3506(a) of Title 44, U.S. Code.

Waivers shall be granted only when:

a. Compliance with a standard would adversely affect the

accomplishment of the mission of an operator of a Federal computer

system, or

b. Cause a major adverse affect the accomplishment of the mission

of an operator which is not offset by Government-wide savings.

Agency heads may act upon a written waiver request containing the

information detailed above. Agency heads may also act without a written

waiver request when they determine that conditions for meeting the

standard cannot be met. Agency heads may approve waivers only by a

written decision which explains the basis on which the agency head made

the required finding(s). A copy of each such decision, with procurement

sensitive or classified portions clearly identified, shall be sent to:

National Institute of Standards and Technology; Attn: FIPS Waiver

Decisions, Technology Building, Room B-154; Gaithersburg, MD 20899.

In addition, notice of each waiver granted and each delegation of

authority to approve waivers shall be sent promptly to the Committee on

Government Reform and Oversight of the House of Representatives and the

Committee on Governmental Affairs of the Senate and shall be published

promptly in the Federal Register.

When the determination on a waiver applies to the procurement of

equipment and/or services, a notice of the waiver determination must be

published in the Commerce Business Daily as part of the notice of

solicitation for offers of an acquisition or, if the waiver

determination is made after that notice is published, by amendment to

such notice.

A copy of the waiver, any supporting documents, the document

approving the waiver and any supporting and accompanying documents,

with such deletions as the agency is authorized and decides to make

under 5 U.S.C. Sec. 552(b), shall be part of the procurement

documentation and retained by the agency.

[[Page 25632]]

13. Where to Obtain Copies of NIST Publications. Copies of this

publication and NIST publications referenced in Section 6 are for sale

by the National Technical Information Service (NTIS), U.S. Department

of Commerce, Springfield, VA 22161; phone (703) 487-4650. When ordering

this publication, refer to Federal Information Processing Standards

Publication 161-2 (FIPSPUB161-2), and title. Payment may be made by

check, money order, or NTIS deposit account.

[FR Doc. 96-12748 Filed 5-21-96; 8:45 am]

BILLING CODE 3510-CN-M