Management of Federal Information Resources

SUMMARY: The Office of Management and Budget (OMB) is revising Appendix

III, ``Security of Federal Information Systems,'' of Circular No. A-

130, ``Management of Federal Automated Information Resources.'' This is

the third stage of planned revisions to Circular A-130. Enactment of

the Information Technology Management Reform Act of 1996 (Division E of

the National Defense Authorization Act for Fiscal Year 1996) will

require OMB to issue additional guidance on capital planning,

investment control, and the management of information technology. A

plan for those revisions will be announced in the Spring.

Transmittal 1 to Circular A-130, effective June 25, 1993, and

published on July 2, 1993 (58 FR 36068) addressed the Information

Management Policy section of the Circular (Section 8a), as well as

Appendix I, ``Federal Agency Responsibilities for Maintaining Records

About Individuals.'' That issuance dealt primarily with how the Federal

government manages its information holdings, particularly information

exchange with the public.

Transmittal 2 to Circular A-130, effective July 15, 1994, and

published on July 25, 1994 (59 FR 37906) addressed agency management

practices for information systems and information technology (Section

8b). That issuance was intended to (1) promote agency investments in

information technology that improve service delivery to the public,

reduce burden on the public, and lower the cost of Federal programs

administration, and (2) encourage agencies to use information

technology as a strategic resource to improve Federal work processes

and organization.

This Transmittal 3 is intended to guide agencies in securing

government information resources as they increasingly rely on an open

and interconnected National Information Infrastructure. It stresses

management controls, such as individual responsibility, awareness and

training, and accountability, and explains how they can be supported by

technical controls. Among other things, it requires agencies to assure

that risk-based rules of behavior are established, that employees are

trained in them, and that the rules are enforced. The revision also

integrates security into program and mission goals, reduces the

centralized reporting of security plans, emphasizes the management of

risk rather than its measurement, and revises government-wide security

responsibilities to be consistent with the Computer Security Act and

the Paperwork Reduction Act of 1995.

This transmittal also makes minor technical revisions to Section 9

(``Assignment of Responsibilities'') and Section 10 (``Oversight'') to

reflect the Paperwork Reduction Act of 1995 (Pub. L. 104-13). One

substantive change has been made to Appendix I in Section 3.a. changing

the annual requirement to review recordkeeping practices, training,

violations, and notices to a biennial review, in accordance with other

regular agency reviews not required by statute. Several minor changes

have been made, none of which are intended to be substantive. In

Section 2.c., a portion of the definition of ``nonfederal agency''

which has been inadvertently omitted has been added to reflect the

current practice in state-federal matching programs. In Section 3.a.,

extraneous and confusing language referring to source or matching

agencies was removed because the provision applies to any agency that

participates in a matching program. The example's in 4.c.(1) were

updated for clarity. Other editorial and organizational changes were

made throughout the appendix.

Appendix IV has been changed to include material from OMB

Memorandum M-95-22, ``Implementing the Information Dissemination

Provisions of the Paperwork Reduction Act of 1995'' (September 29,

1995), and to delete some outdated or otherwise already implemented

guidance from the discussion of Sections 9 and 10.

ELECTRONIC AVAILABILITY: This document is available on the OMB Home

page of Welcome to the White House World Wide Web site (http://

www.whitehouse.gov) as http://www1.whitehouse.gov/White-House/EOP/OMB/

html/omb-a130.html. This document is also available on the Internet via

anonymous File Transfer Protocol (FTP) from the National Institute of

Standards and Technology (NIST) Computer Security Resource

Clearinghouse at csrc.ncsl.nist.gov as /pub/secplcy/a130.txt (do not

use any capital letters in the file name) or via the World Wide Web

from http://csrc.ncsl.nist.gov/secplcy as a130.txt. Appendix III,

``Security of Federal Automated Information Resources'' can be

separately obtained as a130app3.txt. The clearinghouse can also be

reached using dial-in access at 301-948-5717. For those who do not have

file transfer capability, the document can be retrieved via mail query

by sending an electronic mail message to [email protected]

with no subject and with send a130.txt (or a130app3.txt for only the

security appendix) as the first line of the body of the message. Paper

copies may also be obtained by writing to the Publications Office,

Office of Management and Budget, Room 2200 NEOB, Washington, D.C. 20503

or by telephone at (202) 395-7332.

FOR FURTHER INFORMATION CONTACT: Information Policy and Technology

Branch, Office of Information and Regulatory Affairs, Office of

Management and Budget, Room 10236, New Executive Office Building,

Washington, D.C. 20503. Telephone: (202) 395-3785.

SUPPLEMENTARY INFORMATION:

Since December 30, 1985, Appendix III of Office of Management and

Budget (OMB) Circular No. A-130, ``Security of Federal Automated

Information Systems,'' has defined a minimum set of controls for the

security of Federal automated information systems (50 FR 52730). That

Appendix, and its predecessor, Transmittal Memorandum No. 1 to OMB

Circular No. A-71, (July 27, 1978), defined controls that were

considered effective in a centralized processing environment which ran

primarily custom-developed application software.

Today's computing environment is significantly different. It is

characterized by open, widely distributed processing systems which

frequently operate with commercial off-the-shelf software. While

effective use of information technology often reduces risks to the

Federal program being administered (e.g., risks from fraud or errors),

the risk to and vulnerability of Federal information resources has

increased. Greater risks result from increasing quantities of valuable

information being committed to Federal systems, and from agencies being

critically dependent on those systems to perform their missions.

Greater vulnerabilities exist because virtually every Federal employee

has access to Federal systems, and because these systems now

interconnect with outside systems.

In part because of these trends, Congress enacted the Computer

Security Act of 1987 (Pub. L. 100-235). That Act requires agencies to

improve the

[[Page 6429]]

security of Federal computer systems, plan for the security of

sensitive systems, and provide mandatory awareness and training in

security for all individuals with access to computer systems.

To assist agencies in implementing the Computer Security Act, OMB

issued Bulletin No. 88-16, ``Guidance for Preparation and Submission of

Security Plans for Federal Computer Systems Containing Sensitive

Information'' (July 6, 1988), and OMB Bulletin No. 90-08, ``Guidance

for Preparation of Security Plans for Federal Computer Systems that

Contain Sensitive Information'' (July 9, 1990). This revision of

Appendix III to OMB Circular A-130 incorporates and updates the

policies set out in those Bulletins and supersedes them.

The report of the National Performance Review, ``Creating a

Government that Works Better & Costs Less: Reengineering through

Information Technology'' (September 1993), recommended that Circular A-

130 be revised to: (1) Require an information security plan to be part

of each agency's strategic information technology (IT) plan; (2)

require that if computer security does not meet established thresholds,

it be identified as a material weakness in the Federal Managers'

Financial Integrity Act report; (3) require awareness and training of

employees and contractors; (4) require that agencies improve planning

for contingencies; and (5) establish and employ formal emergency

response capabilities. Those recommendations are incorporated in this

revision.

Since its establishment by the Computer Security Act, the Computer

System Security and Privacy Advisory Board has recommended changes in

Circular A-130 to: (1) Require that agencies establish computer

emergency response teams; and (2) link oversight of Federal computer

security activities more closely to the oversight established pursuant

to the Federal Manager's Financial Integrity Act (FMFIA), Public Law

97-255. This revision incorporates both of those recommendations.

Subsequent to issuance of Bulletin 90-08, OMB, the National

Institute of Standards and Technology (NIST), and the National Security

Agency (NSA) met with 28 Federal departments and agencies to review

their computer security programs. In February 1993, OMB, NIST and NSA

issued a report (``Observations of Agency Computer Security Practices

and Implementation of OMB Bulletin No. 90-08'') which summarized those

meetings and proposed several changes in OMB Circular A-130 as next

steps to improving the Federal computer security program. Those

proposed changes are incorporated in this revision.

The revised Appendix clarifies the relationship between

requirements to protect information classified pursuant to an Executive

Order and the requirements in this Appendix. Where an agency processes

information which is controlled for national security reasons pursuant

to an Executive Order or statute, security measures required by

appropriate directives should be included in agency systems. Those

policies, procedures, and practices will be coordinated with the U.S.

Security Policy Board as directed by the President.

On May 22, 1995, the President signed into law the Paperwork

Reduction Act of 1995, Public Law 104-13. That Act, in 44 U.S.C. 3505

and 3506, requires agencies to establish computer security programs,

and it tasks OMB to develop and oversee the implementation of policies,

principles, standards and guidelines on security. It also requires

Federal agencies to identify and provide security protection consistent

with the Computer Security Act of 1987 (40 U.S.C. 759 note). This

revision is intended to implement those OMB responsibilities.

Comments on the Proposed Appendix

On April 3, 1995, the revised Appendix was proposed for public

comment (60 FR 16970). It was also sent directly to Federal agencies

for comment and made available for comment via the Internet. Thirty-two

comments were received. The comments supported the approach proposed in

the revised Appendix. They also made a number of suggestions to improve

it. The principal issues raised in comments and our response to them

are set forth below.

1. Most of the comments stated that the preamble accompanying the

proposed Appendix was useful in their understanding of the Appendix

itself. They suggested that the information in the preamble be

incorporated in the final Appendix for improved future understanding.

We agree with this suggestion, and have incorporated the preamble,

as revised to accommodate changes made to the proposed Appendix, as

part B of the final Appendix.

2. Many comments suggested that the terminology of the Appendix

should be more directive.

We generally agree with this comment, and have changed part A of

the Appendix to be directive, while leaving the descriptive material in

part B as explanatory.

3. A number of comments noted that there is a difference between

making individuals aware of security needs and training them. They

suggested that the Appendix should clarify this distinction and the

requirements associated with each.

We agree, and have made changes in the Appendix and the descriptive

information in part B to clarify that the requirements for training are

consistent with the Computer Security Act (i.e., for increasing

computer security awareness and training in accepted security

practice).

We have also added a clarification that training for members of the

public who are given access to general support systems should normally

be accomplished in the context of the application to which they are

given access. As was pointed out in comments, members of the public

should not be given direct access to general support systems, except

through authorized use of an application. We have also added

descriptive language in part B to address the need to train members of

the public with access to major applications.

4. Several comments raised a concern about the proposed requirement

to limit access to systems until a new employee has been trained in

security responsibilities. They suggested that training be required to

be completed within a certain amount of time after access is granted

(e.g., 60 days).

We disagree. Understanding the security requirements that are

integral to a system is a fundamental responsibility of each individual

who accesses the system. It should not be delayed for administrative

convenience. Furthermore, security training should be included as part

of general training in use of the system for an employee. Initial

awareness and training need not be accomplished through formal

classroom training; in some cases it may be through interactive

sessions of reading well-written and understandable rules. The critical

factor is for the initial and subsequent awareness and training to be

commensurate with the risk and magnitude of harm that could occur.

Therefore, new employees can and should be trained in their security

responsibilities before access is granted. The final Appendix includes

this requirement.

5. Several comments expressed concern about the proposed removal of

the requirement for agencies to prepare formal risk analyses. They

point out that such analyses assist in identifying

[[Page 6430]]

threats, vulnerabilities, and risks to a system. They expressed a

concern that without such analyses it would be difficult to convince

senior management of the need for security. Other comments said that

without risk analysis as the basis of decisions, security measures will

not be effective. On the other hand, several comments supported the

removal of this requirement, which they found not cost-effective.

We agree that security measures must be risk-based. The Computer

Security Act requires that security controls be commensurate with the

risk and magnitude of harm that could occur. Implicit in that approach

is a need to assess the risk to each system. However, given the

complexity and detail such formal analyses often entail, a formal risk

analysis is not appropriate for every system. Therefore, the Appendix

does not require that a formal risk analysis be performed.

At the same time, risk assessment is an essential element in

ensuring adequate security. NIST recently issued a handbook, ``An

Introduction to Computer Security: The NIST Handbook'' (March 16,

1995), which contains guidance on computer security risk management and

provides a flexible framework for performing meaningful risk

assessments. Part B references the NIST handbook.

6. Several comments asked about the relation between the rules of

behavior required in the Appendix and operating policies prescribed in

the NIST Handbook. Other comments made suggestions about the kind and

scope of rules that should be included in the security plan.

We have added language to part B to describe the kinds of rules we

believe are appropriate and to clarify that rules of behavior in the

Appendix should be consistent with the system-specific policies

described in the NIST handbook.

7. Several comments raised a concern about the effectiveness of

reviews of security controls unless they are performed by independent

reviewers.

An independent review can improve the objectivity of the review, as

well as its value to top management in assessing the need for

corrective action. Therefore, we have added language to the discussion

in part B of the Appendix that clarifies that reviews of major

applications, because of their higher risk, should be independent. We

have not, however, required that reviews of all general support systems

be independent. Nevertheless, given the value of an independent review,

agencies may elect to use this approach, particularly where a system

supports a high-risk agency function.

In addition, we understand that the U.S. General Accounting Office

is developing guidance which provides a structured approach for

performing reviews. We have also revised the Appendix to be consistent

with OMB Circular No. A-123, ``Management Accountability and Control''

(June 21, 1995).

8. Several comments requested additional guidance on enforcement of

the rules of behavior, either from the Department of Justice or the

Office of Personnel Management (OPM).

The presumption in requiring rules of behavior is that they would

be enforced as are other behavioral rules within an agency. Therefore,

we are not proposing to have central guidance developed by either

Justice or OPM. However, we expect that agencies will share their

various approaches through inter-agency forums, such as the Computer

Security Program Managers' Forum. We have added a brief discussion of

this point to part B.

9. Several comments concerned the protection of shared information

and requested that additional guidance be provided. We have clarified

our intent in the discussion in part B.

10. One comment raised a concern about the Appendix's apparent

subordination of technical controls to management controls. While we

are stressing the importance of management controls, we have added

preamble language to clarify that both types of controls must be in

place to be effective.

11. A number of comments raised a concern about whether adequate

funding would be forthcoming to implement the requirements of the

Appendix.

Implicit in issuing the Appendix is our presumption that a system

is created and maintained with adequate security or it should not be

created or maintained. Security costs should therefore be factored into

the normal capital planning and investment controls process for

information technology, consistent with the information systems and

information technology management requirements in Section 8b of this

circular.

12. A number of comments concerned the government-wide role of the

Security Policy Board. Several favored expanding that role, others

proposed that it be more limited. Still others said the Appendix should

be silent on national security directives.

We have revised the language in the Appendix to clarify the role of

the Security Policy Board regrading security of information technology

used to process classified information. We have also added language to

the preamble which clarifies that Circular No. A-130 and the Appendix

exclude certain mission critical systems, the so-called ``Warner

systems'' from coverage, and to describe the Department of Defense's

responsibilities pursuant to existing Presidential directives. The

Appendix does not attempt to interpret the language of the directives.

Rather, it clarifies that requirements issued pursuant to those

directives should be used in place of the requirements of the Appendix

with respect to the protection of classified information. The

discussion of national security directives is included to assist in the

coordination of security activities among various security communities.

Accordingly, Circular A-130 is revised as set forth below.

Sally Katzen,

Administrator, Office of Information and Regulatory Affairs.

Executive Office of the President

Office of Management and Budget

February 8, 1996.

Circular No. A-130, Revised (Transmittal Memorandum No. 3)

Memorandum for Heads of Executive Departments and Establishments

Subject: Management of Federal Information Resources.

Circular No. A-130 provides uniform government-wide information

resources management policies as required by the Paperwork Reduction

Act of 1980, as amended by the Paperwork Reduction Act of 1995, 44

U.S.C. Chapter 35. This Transmittal Memorandum contains updated

guidance on the ``Security of Federal Automated Information

Systems,'' Appendix III and makes minor technical revisions to the

Circular to reflect the Paperwork Reduction Act of 1995 (Pub. L.

104-13). The Circular is reprinted in its entirety for convenience.

Alice M. Rivlin,

Director.

Attachment

Circular No. A-130 Revised (Transmittal Memorandum No. 3)

Memorandum for Heads of Executive Departments and Establishments

Subject: Management of Federal Information Resources.

1. Purpose: This Circular establishes policy for the management

of Federal information resources. Procedural and analytic guidelines

for implementing specific aspects of these policies are included as

appendices.

2. Rescissions: This Circular rescinds OMB Circulars No. A-3, A-

71, A-90, A-108, A-114, and A-121, and all Transmittal Memoranda to

those circulars.

3. Authorities: This Circular is issued pursuant to the

Paperwork Reduction Act (PRA) of 1980, as amended by the Paperwork

Reduction Act of 1995 (44 U.S.C. Chapter

[[Page 6431]]

35); the Privacy Act, as amended (5 U.S.C. 552a); the Chief Financial

Officers Act (31 U.S.C. 3512 et seq.); the Federal Property and

Administrative Services Act, as amended (40 U.S.C. 759 and 487); the

Computer Security Act (40 U.S.C. 759 note); the Budget and

Accounting Act, as amended (31 U.S.C. Chapter 11); Executive Order

No. 12046 of March 27, 1978; and Executive Order No. 12472 of April

3, 1984.

4. Applicability and Scope:

a. The policies in this Circular apply to the information

activities of all agencies of the executive branch of the Federal

government.

b. Information classified for national security purposes should

also be handled in accordance with the appropriate national security

directives. National security emergency preparedness activities

should be conducted in accordance with Executive Order No. 12472.

5. Background: The Paperwork Reduction Act establishes a broad

mandate for agencies to perform their information resources

management activities in an efficient, effective, and economical

manner. To assist agencies in an integrated approach to information

resources management, the Act requires that the Director of OMB

develop and implement uniform and consistent information resources

management policies; oversee the development and promote the use of

information management principles, standards, and guidelines;

evaluate agency information resources management practices in order

to determine their adequacy and efficiency; and determine compliance

of such practices with the policies, principles, standards, and

guidelines promulgated by the Director.

6. Definitions:

a. The term ``agency'' means any executive department, military

department, government corporation, government controlled

corporation, or other establishment in the executive branch of the

Federal government, or any independent regulatory agency. Within the

Executive Office of the President, the term includes only OMB and

the Office of Administration.

b. The term ``audiovisual production'' means a unified

presentation, developed according to a plan or script, containing

visual imagery, sound or both, and used to convey information.

c. The term ``dissemination'' means the government initiated

distribution of information to the public. Not considered

dissemination within the meaning of this Circular is distribution

limited to government employees or agency contractors or grantees,

intra- or inter-agency use or sharing of government information, and

responses to requests for agency records under the Freedom of

Information Act (5 U.S.C. 552) or Privacy Act.

d. The term ``full costs,'' when applied to the expenses

incurred in the operation of an information processing service

organization (IPSO), is comprised of all direct, indirect, general,

and administrative costs incurred in the operation of an IPSO. These

costs include, but are not limited to, personnel, equipment,

software, supplies, contracted services from private sector

providers, space occupancy, intra-agency services from within the

agency, inter-agency services from other Federal agencies, other

services that are provided by State and local governments, and

Judicial and Legislative branch organizations.

e. The term ``government information'' means information

created, collected, processed, disseminated, or disposed of by or

for the Federal Government.

f. The term ``government publication'' means information which

is published as an individual document at government expense, or as

required by law. (44 U.S.C. 1901)

g. The term ``information'' means any communication or

representation of knowledge such as facts, data, or opinions in any

medium or form, including textual, numerical, graphic, cartographic,

narrative, or audiovisual forms.

h. The term ``information dissemination product'' means any

book, paper, map, machine-readable material, audiovisual production,

or other documentary material, regardless of physical form or

characteristic, disseminated by an agency to the public.

i. The term ``information life cycle'' means the stages through

which information passes, typically characterized as creation or

collection, processing, dissemination, use, storage, and

disposition.

j. The term ``information management'' means the planning,

budgeting, manipulating, and controlling of information throughout

its life cycle.

k. The term ``information resources'' includes both government

information and information technology.

l. The term ``information processing services organization''

(IPSO) means a discrete set of personnel, information technology,

and support equipment with the primary function of providing

services to more than one agency on a reimbursable basis.

m. The term ``information resources management'' means the

process of managing information resources to accomplish agency

missions. The term encompasses both information itself and the

related resources, such as personnel, equipment, funds, and

information technology.

n. The term ``information system'' means a discrete set of

information resources organized for the collection, processing,

maintenance, transmission, and dissemination of information, in

accordance with defined procedures, whether automated or manual.

o. The term ``information system life cycle'' means the phases

through which an information system passes, typically characterized

as initiation, development, operation, and termination.

p. The term ``information technology'' means the hardware and

software operated by a Federal agency or by a contractor of a

Federal agency or other organization that processes information on

behalf of the Federal government to accomplish a Federal function,

regardless of the technology involved, whether computers,

telecommunications, or others. It includes automatic data processing

equipment as that term is defined in Section 111(a)(2) of the

Federal Property and Administrative Services Act of 1949. For the

purposes of this Circular, automatic data processing and

telecommunications activities related to certain critical national

security missions, as defined in 44 U.S.C. 3502(2) and 10 U.S.C.

2315, are excluded.

q. The term ``major information system'' means an information

system that requires special management attention because of its

importance to an agency mission; its high development, operating, or

maintenance costs; or its significant role in the administration of

agency programs, finances, property, or other resources.

r. The term ``records'' means all books, papers, maps,

photographs, machine-readable materials, or other documentary

materials, regardless of physical form or characteristics, made or

received by an agency of the United States Government under Federal

law or in connection with the transaction of public business and

preserved or appropriate for preservation by that agency or its

legitimate successor as evidence of the organization, functions,

policies, decisions, procedures, operations, or other activities of

the government or because of the informational value of the data in

them. Library and museum material made or acquired and preserved

solely for reference or exhibition purposes, extra copies of

documents preserved only for convenience of reference, and stocks of

publications and of processed documents are not included. (44 U.S.C.

3301)

s. The term ``records management'' means the planning,

controlling, directing, organizing, training, promoting, and other

managerial activities involved with respect to records creation,

records maintenance and use, and records disposition in order to

achieve adequate and proper documentation of the policies and

transactions of the Federal Government and effective and economical

management of agency operations. (44 U.S.C. 2901(2))

t. The term ``service recipient'' means an agency organizational

unit, programmatic entity, or chargeable account that receives

information processing services from an information processing

service organization (IPSO). A service recipient may be either

internal or external to the organization responsible for providing

information resources services, but normally does not report either

to the manager or director of the IPSO or to the same immediate

supervisor.

7. Basic Considerations and Assumptions:

a. The Federal Government is the largest single producer,

collector, consumer, and disseminator of information in the United

States. Because of the extent of the government's information

activities, and the dependence of those activities upon public

cooperation, the management of Federal information resources is an

issue of continuing importance to all Federal agencies, State and

local governments, and the public.

b. Government information is a valuable national resource. It

provides the public with knowledge of the government, society, and

economy--past, present, and future. It is a means to ensure the

accountability of government, to manage the government's operations,

to maintain the healthy performance of the economy, and is itself a

commodity in the marketplace.

[[Page 6432]]

c. The free flow of information between the government and the

public is essential to a democratic society. It is also essential

that the government minimize the Federal paperwork burden on the

public, minimize the cost of its information activities, and

maximize the usefulness of government information.

d. In order to minimize the cost and maximize the usefulness of

government information, the expected public and private benefits

derived from government information should exceed the public and

private costs of the information, recognizing that the benefits to

be derived from government information may not always be

quantifiable.

e. The nation can benefit from government information

disseminated both by Federal agencies and by diverse nonfederal

parties, including State and local government agencies, educational

and other not-for-profit institutions, and for-profit organizations.

f. Because the public disclosure of government information is

essential to the operation of a democracy, the management of Federal

information resources should protect the public's right of access to

government information.

g. The individual's right to privacy must be protected in

Federal Government information activities involving personal

information.

h. Systematic attention to the management of government records

is an essential component of sound public resources management which

ensures public accountability. Together with records preservation,

it protects the government's historical record and guards the legal

and financial rights of the government and the public.

i. Agency strategic planning can improve the operation of

government programs. The application of information resources should

support an agency's strategic plan to fulfill its mission. The

integration of IRM planning with agency strategic planning promotes

the appropriate application of Federal information resources.

j. Because State and local governments are important producers

of government information for many areas such as health, social

welfare, labor, transportation, and education, the Federal

Government must cooperate with these governments in the management

of information resources.

k. The open and efficient exchange of scientific and technical

government information, subject to applicable national security

controls and the proprietary rights of others, fosters excellence in

scientific research and effective use of Federal research and

development funds.

l. Information technology is not an end in itself. It is one set

of resources that can improve the effectiveness and efficiency of

Federal program delivery.

m. Federal Government information resources management policies

and activities can affect, and be affected by, the information

policies and activities of other nations.

n. Users of Federal information resources must have skills,

knowledge, and training to manage information resources, enabling

the Federal government to effectively serve the public through

automated means.

o. The application of up-to-date information technology presents

opportunities to promote fundamental changes in agency structures,

work processes, and ways of interacting with the public that improve

the effectiveness and efficiency of Federal agencies.

p. The availability of government information in diverse media,

including electronic formats, permits agencies and the public

greater flexibility in using the information.

q. Federal managers with program delivery responsibilities

should recognize the importance of information resources management

to mission performance.

8. Policy

a. Information Management Policy:

(1) Information Management Planning. Agencies shall plan in an

integrated manner for managing information throughout its life

cycle. Agencies shall:

(a) Consider, at each stage of the information life cycle, the

effects of decisions and actions on other stages of the life cycle,

particularly those concerning information dissemination;

(b) Consider the effects of their actions on members of the

public and ensure consultation with the public as appropriate;

(c) Consider the effects of their actions on State and local

governments and ensure consultation with those governments as

appropriate;

(d) Seek to satisfy new information needs through interagency or

intergovernmental sharing of information, or through commercial

sources, where appropriate, before creating or collecting new

information;

(e) Integrate planning for information systems with plans for

resource allocation and use, including budgeting, acquisition, and

use of information technology;

(f) Train personnel in skills appropriate to management of

information;

(g) Protect government information commensurate with the risk

and magnitude of harm that could result from the loss, misuse, or

unauthorized access to or modification of such information;

(h) Use voluntary standards and Federal Information Processing

Standards where appropriate or required;

(i) Consider the effects of their actions on the privacy rights

of individuals, and ensure that appropriate legal and technical

safeguards are implemented;

(j) Record, preserve, and make accessible sufficient information

to ensure the management and accountability of agency programs, and

to protect the legal and financial rights of the Federal Government;

(k) Incorporate records management and archival functions into

the design, development, and implementation of information systems;

(l) Provide for public access to records where required or

appropriate.

(2) Information Collection. Agencies shall collect or create

only that information necessary for the proper performance of agency

functions and which has practical utility.

(3) Electronic Information Collection. Agencies shall use

electronic collection techniques where such techniques reduce burden

on the public, increase efficiency of government programs, reduce

costs to the government and the public, and/or provide better

service to the public. Conditions favorable to electronic collection

include:

(a) The information collection seeks a large volume of data and/

or reaches a large proportion of the public;

(b) The information collection recurs frequently;

(c) The structure, format, and/or definition of the information

sought by the information collection does not change significantly

over several years;

(d) The agency routinely converts the information collected to

electronic format;

(e) A substantial number of the affected public are known to

have ready access to the necessary information technology and to

maintain the information in electronic form;

(f) Conversion to electronic reporting, if mandatory, will not

impose substantial costs or other adverse effects on the public,

especially State and local governments and small business entities.

(4) Records Management. Agencies shall:

(a) Ensure that records management programs provide adequate and

proper documentation of agency activities;

(b) Ensure the ability to access records regardless of form or

medium;

(c) In a timely fashion, establish, and obtain the approval of

the Archivist of the United States for, retention schedules for

Federal records; and

(d) Provide training and guidance as appropriate to all agency

officials and employees and contractors regarding their Federal

records management responsibilities.

(5) Providing Information to the Public. Agencies have a

responsibility to provide information to the public consistent with

their missions. Agencies shall discharge this responsibility by:

(a) Providing information, as required by law, describing agency

organization, activities, programs, meetings, systems of records,

and other information holdings, and how the public may gain access

to agency information resources;

(b) Providing access to agency records under provisions of the

Freedom of Information Act and the Privacy Act, subject to the

protections and limitations provided for in these Acts;

(c) Providing such other information as is necessary or

appropriate for the proper performance of agency functions; and

(d) In determining whether and how to disseminate information to

the public, agencies shall:

(i) Disseminate information in a manner that achieves the best

balance between the goals of maximizing the usefulness of the

information and minimizing the cost to the government and the

public;

(ii) Disseminate information dissemination products on

equitable and timely terms;

(iii) Take advantage of all dissemination channels, Federal and

nonfederal, including State and local governments, libraries and

private sector entities, in discharging agency information

dissemination responsibilities;

(iv) Help the public locate government information maintained

by or for the agency.

(6) Information Dissemination Management System. Agencies shall

maintain and

[[Page 6433]]

implement a management system for all information dissemination

products which shall, at a minimum:

(a) Assure that information dissemination products are necessary

for proper performance of agency functions (44 U.S.C. 1108);

(b) Consider whether an information dissemination product

available from other Federal or nonfederal sources is equivalent to

an agency information dissemination product and reasonably fulfills

the dissemination responsibilities of the agency;

(c) Establish and maintain inventories of all agency information

dissemination products;

(d) Develop such other aids to locating agency information

dissemination products including catalogs and directories, as may

reasonably achieve agency information dissemination objectives;

(e) Identify in information dissemination products the source of

the information, if from another agency;

(f) Ensure that members of the public with disabilities whom the

agency has a responsibility to inform have a reasonable ability to

access the information dissemination products;

(g) Ensure that government publications are made available to

depository libraries through the facilities of the Government

Printing Office, as required by law (44 U.S.C. Part 19);

(h) Provide electronic information dissemination products to the

Government Printing Office for distribution to depository libraries;

(i) Establish and maintain communications with members of the

public and with State and local governments so that the agency

creates information dissemination products that meet their

respective needs;

(j) Provide adequate notice when initiating, substantially

modifying, or terminating significant information dissemination

products; and

(k) Ensure that, to the extent existing information

dissemination policies or practices are inconsistent with the

requirements of this Circular, a prompt and orderly transition to

compliance with the requirements of this Circular is made.

(7) Avoiding Improperly Restrictive Practices. Agencies shall:

(a) Avoid establishing, or permitting others to establish on

their behalf, exclusive, restricted, or other distribution

arrangements that interfere with the availability of information

dissemination products on a timely and equitable basis;

(b) Avoid establishing restrictions or regulations, including

the charging of fees or royalties, on the reuse, resale, or

redissemination of Federal information dissemination products by the

public; and,

(c) Set user charges for information dissemination products at a

level sufficient to recover the cost of dissemination but no higher.

They shall exclude from calculation of the charges costs associated

with original collection and processing of the information.

Exceptions to this policy are:

(i) Where statutory requirements are at variance with the

policy;

(ii) Where the agency collects, processes, and disseminates the

information for the benefit of a specific identifiable group beyond

the benefit to the general public;

(iii) Where the agency plans to establish user charges at less

than cost of dissemination because of a determination that higher

charges would constitute a significant barrier to properly

performing the agency's functions, including reaching members of the

public whom the agency has a responsibility to inform; or

(iv) Where the Director of OMB determines an exception is

warranted.

(8) Electronic Information Dissemination. Agencies shall use

electronic media and formats, including public networks, as

appropriate and within budgetary constraints, in order to make

government information more easily accessible and useful to the

public. The use of electronic media and formats for information

dissemination is appropriate under the following conditions:

(a) The agency develops and maintains the information

electronically;

(b) Electronic media or formats are practical and cost effective

ways to provide public access to a large, highly detailed volume of

information;

(c) The agency disseminates the product frequently;

(d) The agency knows a substantial portion of users have ready

access to the necessary information technology and training to use

electronic information dissemination products;

(e) A change to electronic dissemination, as the sole means of

disseminating the product, will not impose substantial acquisition

or training costs on users, especially State and local governments

and small business entities.

(9) Safeguards. Agencies shall:

(a) Ensure that information is protected commensurate with the

risk and magnitude of the harm that would result from the loss,

misuse, or unauthorized access to or modification of such

information;

(b) Limit the collection of information which identifies

individuals to that which is legally authorized and necessary for

the proper performance of agency functions;

(c) Limit the sharing of information that identifies individuals

or contains proprietary information to that which is legally

authorized, and impose appropriate conditions on use where a

continuing obligation to ensure the confidentiality of the

information exists;

(d) Provide individuals, upon request, access to records about

them maintained in Privacy Act systems of records, and permit them

to amend such records as are in error consistent with the provisions

of the Privacy Act.

b. Information Systems and Information Technology Management

(1) Evaluation and Performance Measurement. Agencies shall

promote the appropriate application of Federal information resources

as follows:

(a) Seek opportunities to improve the effectiveness and

efficiency of government programs through work process redesign and

the judicious application of information technology;

(b) Prepare, and update as necessary throughout the information

system life cycle, a benefit-cost analysis for each information

system:

(i) At a level of detail appropriate to the size of the

investment;

(ii) Consistent with the methodology described in OMB Circular

No. A-94, ``Guidelines and Discount Rates for Benefit-Cost Analysis

of Federal Programs;'' and

(iii) that relies on systematic measures of mission performance,

including the:

(a) Effectiveness of program delivery;

(b) Efficiency of program administration; and

(c) Reduction in burden, including information collection

burden, imposed on the public;

(c) Conduct benefit-cost analyses to support ongoing management

oversight processes that maximize return on investment and minimize

financial and operational risk for investments in major information

systems on an agency-wide basis; and

(d) Conduct post-implementation reviews of information systems

to validate estimated benefits and document effective management

practices for broader use.

(2) Strategic Information Resources Management (IRM) Planning.

Agencies shall establish and maintain strategic information

resources management planning processes which include the following

components:

(a) Strategic IRM planning that addresses how the management of

information resources promotes the fulfillment of an agency's

mission. This planning process should support the development and

maintenance of a strategic IRM plan that reflects and anticipates

changes in the agency's mission, policy direction, technological

capabilities, or resource levels;

(b) Information planning that promotes the use of information

throughout its life cycle to maximize the usefulness of information,

minimize the burden on the public, and preserve the appropriate

integrity, availability, and confidentiality of information. It

shall specifically address the planning and budgeting for the

information collection burden imposed on the public as defined by 5

CFR 1320;

(c) Operational information technology planning that links

information technology to anticipated program and mission needs,

reflects budget constraints, and forms the basis for budget

requests. This planning should result in the preparation and

maintenance of an up-to-date five-year plan, as required by 44

U.S.C. 3506, which includes:

(i) A listing of existing and planned major information systems;

(ii) A listing of planned information technology acquisitions;

(iii) An explanation of how the listed major information systems

and planned information technology acquisitions relate to each other

and support the achievement of the agency's mission; and

(iv) A summary of computer security planning, as required by

Section 6 of the Computer Security Act of 1987 (40 U.S.C. 759 note);

and

(d) Coordination with other agency planning processes including

strategic, human resources, and financial resources.

[[Page 6434]]

(3) Information Systems Management Oversight. Agencies shall

establish information system management oversight mechanisms that:

(a) Ensure that each information system meets agency mission

requirements;

(b) Provide for periodic review of information systems to

determine:

(i) How mission requirements might have changed;

(ii) Whether the information system continues to fulfill ongoing

and anticipated mission requirements; and

(iii) What level of maintenance is needed to ensure the

information system meets mission requirements cost effectively;

(c) Ensure that the official who administers a program supported

by an information system is responsible and accountable for the

management of that information system throughout its life cycle;

(d) Provide for the appropriate training for users of Federal

information resources;

(e) Prescribe Federal information system requirements that do

not unduly restrict the prerogatives of State, local, and tribal

governments;

(f) Ensure that major information systems proceed in a timely

fashion towards agreed-upon milestones in an information system life

cycle, meet user requirements, and deliver intended benefits to the

agency and affected publics through coordinated decision making

about the information, human, financial, and other supporting

resources; and

(g) Ensure that financial management systems conform to the

requirements of OMB Circular No. A-127, ``Financial Management

Systems.''

(4) Use of Information Resources. Agencies shall create and

maintain management and technical frameworks for using information

resources that document linkages between mission needs, information

content, and information technology capabilities. These frameworks

should guide both strategic and operational IRM planning. They

should also address steps necessary to create an open systems

environment. Agencies shall implement the following principles:

(a) Develop information systems in a manner that facilitates

necessary interoperability, application portability, and scalability

of computerized applications across networks of heterogeneous

hardware, software, and communications platforms;

(b) Ensure that improvements to existing information systems and

the development of planned information systems do not unnecessarily

duplicate information systems available within the same agency, from

other agencies, or from the private sector;

(c) Share available information systems with other agencies to

the extent practicable and legally permissible;

(d) Meet information technology needs through intra-agency and

inter-agency sharing, when it is cost effective, before acquiring

new information technology resources;

(e) For Information Processing Service Organizations (IPSOs)

that have costs in excess of $5 million per year, agencies shall:

(i) Account for the full costs of operating all IPSOs; (ii)

Recover the costs incurred for providing IPSO services to all

service recipients on an equitable basis commensurate with the costs

required to provide those services; and

(iii) Document sharing agreements between service recipients and

IPSOs; and

(f) Establish a level of security for all information systems

that is commensurate with the risk and magnitude of the harm

resulting from the loss, misuse, or unauthorized access to or

modification of the information contained in these information

systems.

(5) Acquisition of Information Technology. Agencies shall:

(a) Acquire information technology in a manner that makes use of

full and open competition and that maximizes return on investment;

(b) Acquire off-the-shelf software from commercial sources,

unless the cost effectiveness of developing custom software to meet

mission needs is clear and has been documented;

(c) Acquire information technology in accordance with OMB

Circular No. A-109, ``Acquisition of Major Systems,'' where

appropriate; and

(d) Acquire information technology in a manner that considers

the need for accommodations of accessibility for individuals with

disabilities to the extent that needs for such access exist.

9. Assignment of Responsibilities

a. All Federal Agencies. The head of each agency shall:

(1) Have primary responsibility for managing agency information

resources;

(2) Ensure that the information policies, principles, standards,

guidelines, rules, and regulations prescribed by OMB are implemented

appropriately within the agency;

(3) Develop internal agency information policies and procedures

and oversee, evaluate, and otherwise periodically review agency

information resources management activities for conformity with the

policies set forth in this Circular;

(4) Develop agency policies and procedures that provide for

timely acquisition of required information technology;

(5) Maintain an inventory of the agencies' major information

systems, holdings and information dissemination products, as

required by 44 U.S.C. 3511.

(6) Implement and enforce applicable records management policies

and procedures, including requirements for archiving information

maintained in electronic format, particularly in the planning,

design and operation of information systems.

(7) Identify to the Director, OMB, statutory, regulatory, and

other impediments to efficient management of Federal information

resources and recommend to the Director legislation, policies,

procedures, and other guidance to improve such management;

(8) Assist OMB in the performance of its functions under the PRA

including making services, personnel, and facilities available to

OMB for this purpose to the extent practicable;

(9) Appoint a senior official, as required by 44 U.S.C. 3506(a),

who shall report directly to the agency head to carry out the

responsibilities of the agency under the PRA. The head of the agency

shall keep the Director, OMB, advised as to the name, title,

authority, responsibilities, and organizational resources of the

senior official. For purposes of this paragraph, military

departments and the Office of the Secretary of Defense may each

appoint one official.

(10) Direct the senior official appointed pursuant to 44 U.S.C.

3506(a) to monitor agency compliance with the policies, procedures,

and guidance in this Circular. Acting as an ombudsman, the senior

official shall consider alleged instances of agency failure to

comply with this Circular and recommend or take corrective action as

appropriate. The senior official shall report annually, not later

than February 1st of each year, to the Director those instances of

alleged failure to comply with this Circular and their resolution.

b. Department of State. The Secretary of State shall:

(1) Advise the Director, OMB, on the development of United

States positions and policies on international information policy

issues affecting Federal Government information activities and

ensure that such positions and policies are consistent with Federal

information resources management policy;

(2) Ensure, in consultation with the Secretary of Commerce, that

the United States is represented in the development of international

information technology standards, and advise the Director, OMB, of

such activities.

c. Department of Commerce. The Secretary of Commerce shall:

(1) Develop and issue Federal Information Processing Standards

and guidelines necessary to ensure the efficient and effective

acquisition, management, security, and use of information

technology;

(2) Advise the Director, OMB, on the development of policies

relating to the procurement and management of Federal

telecommunications resources;

(3) Provide OMB and the agencies with scientific and technical

advisory services relating to the development and use of information

technology;

(4) Conduct studies and evaluations concerning

telecommunications technology, and concerning the improvement,

expansion, testing, operation, and use of Federal telecommunications

systems and advise the Director, OMB, and appropriate agencies of

the recommendations that result from such studies;

(5) Develop, in consultation with the Secretary of State and the

Director of OMB, plans, policies, and programs relating to

international telecommunications issues affecting government

information activities;

(6) Identify needs for standardization of telecommunications and

information processing technology, and develop standards, in

consultation with the Secretary of Defense and the Administrator of

General Services, to ensure efficient application of such

technology;

(7) Ensure that the Federal Government is represented in the

development of national and, in consultation with the Secretary of

[[Page 6435]]

State, international information technology standards, and advise the

Director, OMB, of such activities.

d. Department of Defense. The Secretary of Defense shall

develop, in consultation with the Administrator of General Services,

uniform Federal telecommunications standards and guidelines to

ensure national security, emergency preparedness, and continuity of

government.

e. General Services Administration. The Administrator of General

Services shall:

(1) Advise the Director, OMB, and agency heads on matters

affecting the procurement of information technology;

(2) Coordinate and, when required, provide for the purchase,

lease, and maintenance of information technology required by Federal

agencies;

(3) Develop criteria for timely procurement of information

technology and delegate procurement authority to agencies that

comply with the criteria;

(4) Provide guidelines and regulations for Federal agencies, as

authorized by law, on the acquisition, maintenance, and disposition

of information technology, and for implementation of Federal

Information Processing Standards;

(5) Develop policies and guidelines that facilitate the sharing

of information technology among agencies as required by this

Circular;

(6) Manage the Information Technology Fund in accordance with

the Federal Property and Administrative Services Act as amended;

f. Office of Personnel Management. The Director, Office of

Personnel Management, shall:

(1) Develop and conduct training programs for Federal personnel

on information resources management including end-user computing;

(2) Evaluate periodically future personnel management and

staffing requirements for Federal information resources management;

(3) Establish personnel security policies and develop training

programs for Federal personnel associated with the design,

operation, or maintenance of information systems.

g. National Archives and Records Administration. The Archivist

of the United States shall:

(1) Administer the Federal records management program in

accordance with the National Archives and Records Act;

(2) Assist the Director, OMB, in developing standards and

guidelines relating to the records management program.

h. Office of Management and Budget. The Director of the Office

of Management and Budget shall:

(1) Provide overall leadership and coordination of Federal

information resources management within the executive branch;

(2) Serve as the President's principal adviser on procurement

and management of Federal telecommunications systems, and develop

and establish policies for procurement and management of such

systems;

(3) Issue policies, procedures, and guidelines to assist

agencies in achieving integrated, effective, and efficient

information resources management;

(4) Initiate and review proposals for changes in legislation,

regulations, and agency procedures to improve Federal information

resources management;

(5) Review and approve or disapprove agency proposals for

collection of information from the public, as defined by 5 CFR

1320.3;

(6) Develop and maintain a Governmentwide strategic plan for

information resources management.

(7) Evaluate agencies' information resources management and

identify cross-cutting information policy issues through the review

of agency information programs, information collection budgets,

information technology acquisition plans, fiscal budgets, and by

other means;

(8) Provide policy oversight for the Federal records management

function conducted by the National Archives and Records

Administration, coordinate records management policies and programs

with other information activities, and review compliance by agencies

with records management requirements;

(9) Review agencies' policies, practices, and programs

pertaining to the security, protection, sharing, and disclosure of

information, in order to ensure compliance, with respect to privacy

and security, with the Privacy Act, the Freedom of Information Act,

the Computer Security Act and related statutes;

(10) Resolve information technology procurement disputes between

agencies and the General Services Administration pursuant to Section

111 of the Federal Property and Administrative Services Act;

(11) Review proposed U.S. Government Position and Policy

statements on international issues affecting Federal Government

information activities and advise the Secretary of State as to their

consistency with Federal information resources management policy.

(12) Coordinate the development and review by the Office of

Information and Regulatory Affairs of policy associated with Federal

procurement and acquisition of information technology with the

Office of Federal Procurement Policy.

10. Oversight:

a. The Director, OMB, will use information technology planning

reviews, fiscal budget reviews, information collection budget

reviews, management reviews, and such other measures as the Director

deems necessary to evaluate the adequacy and efficiency of each

agency's information resources management and compliance with this

Circular.

b. The Director, OMB, may, consistent with statute and upon

written request of an agency, grant a waiver from particular

requirements of this Circular. Requests for waivers must detail the

reasons why a particular waiver is sought, identify the duration of

the waiver sought, and include a plan for the prompt and orderly

transition to full compliance with the requirements of this

Circular. Notice of each waiver request shall be published promptly

by the agency in the Federal Register, with a copy of the waiver

request made available to the public on request.

11. Effectiveness: This Circular is effective upon issuance.

Nothing in this Circular shall be construed to confer a private

right of action on any person.

12. Inquiries: All questions or inquiries should be addressed to

the Office of Information and Regulatory Affairs, Office of

Management and Budget, Washington, D.C. 20503. Telephone: (202) 395-

3785.

13. Sunset Review Date: OMB will review this Circular three

years from the date of issuance to ascertain its effectiveness.

Appendix I to OMB Circular No. A-130--Federal Agency Responsibilities

for Maintaining Records About Individuals

1. Purpose and Scope

This Appendix describes agency responsibilities for implementing

the reporting and publication requirements of the Privacy Act of

1974, 5 U.S.C. 552a, as amended (hereinafter ``the Act''). It

applies to all agencies subject to the Act. Note that this Appendix

does not rescind other guidance OMB has issued to help agencies

interpret the Privacy Act's provisions, e.g., Privacy Act Guidelines

(40 FR 28949-28978, July 9, 1975), or Final Guidance for Conducting

Matching Programs (54 FR at 25819, June 19, 1989).

2. Definitions

a. The terms ``agency,'' ``individual,'' ``maintain,''

``matching program,'' ``record,'' ``system of records,'' and

``routine use,'' as used in this Appendix, are defined in the Act (5

U.S.C. 552a(a)).

b. Matching Agency. Generally, the Recipient Federal agency (or

the Federal source agency in a match conducted by a nonfederal

agency) is the matching agency and is responsible for meeting the

reporting and publication requirements associated with the matching

program. However, in large, multi-agency matching programs, where

the recipient agency is merely performing the matches and the

benefit accrues to the source agencies, the partners should assign

responsibility for compliance with the administrative requirements

in a fair and reasonable way. This may mean having the matching

agency carry out these requirements for all parties, having one

participant designated to do so, or having each source agency do so

for its own matching program(s).

c. Nonfederal Agency. Nonfederal agencies are State or local

governmental agencies receiving or providing records in a matching

program with a Federal agency.

d. Recipient Agency. Recipient agencies are Federal agencies or

their contractors receiving automated records from the Privacy Act

systems of records of other Federal agencies, or from State or local

governments, to be used in a matching program as defined in the Act.

e. Source Agency. A source agency is a Federal agency that

discloses automated records from a system of records to another

Federal agency or to a State or local agency to be used in a

matching program. It is also a State or local agency that discloses

records to a Federal agency for use in a matching program.

[[Page 6436]]

3. Assignment of Responsibilities

a. All Federal Agencies. In addition to meeting the agency

requirements contained in the Act and the specific reporting and

publication requirements detailed in this Appendix, the head of each

agency shall ensure that the following reviews are conducted as

often as specified below, and be prepared to report to the Director,

OMB, the results of such reviews and the corrective action taken to

resolve problems uncovered. The head of each agency shall:

(1) Section (m) Contracts. Review every two years a random

sample of agency contracts that provide for the maintenance of a

system of records on behalf of the agency to accomplish an agency

function, in order to ensure that the wording of each contract makes

the provisions of the Act binding on the contractor and his or her

employees. (See 5 U.S.C. 552a(m)(1)).

(2) Recordkeeping Practices. Review biennially agency

recordkeeping and disposal policies and practices in order to assure

compliance with the Act, paying particular attention to the

maintenance of automated records.

(3) Routine Use Disclosures. Review every four years the routine

use disclosures associated with each system of records in order to

ensure that the recipient's use of such records continues to be

compatible with the purpose for which the disclosing agency

collected the information.

(4) Exemption of Systems of Records. Review every four years

each system of records for which the agency has promulgated

exemption rules pursuant to Section (j) or (k) of the Act in order

to determine whether such exemption is still needed.

(5) Matching Programs. Review annually each ongoing matching

program in which the agency has participated during the year in

order to ensure that the requirements of the Act, the OMB guidance,

and any agency regulations, operating instructions, or guidelines

have been met.

(6) Privacy Act Training. Review biennially agency training

practices in order to ensure that all agency personnel are familiar

with the requirements of the Act, with the agency's implementing

regulation, and with any special requirements of their specific

jobs.

(7) Violations. Review biennially the actions of agency

personnel that have resulted either in the agency being found

civilly liable under Section (g) of the Act, or an employee being

found criminally liable under the provisions of Section (i) of the

Act, in order to determine the extent of the problem, and to find

the most effective way to prevent recurrence of the problem.

(8) Systems of Records Notices. Review biennially each system of

records notice to ensure that it accurately describes the system of

records. Where minor changes are needed, e.g., the name of the

system manager, ensure that an amended notice is published in the

Federal Register. Agencies may choose to make one annual

comprehensive publication consolidating such minor changes. This

requirement is distinguished from and in addition to the requirement

to report to OMB and Congress significant changes to systems of

records and to publish those changes in the Federal Register (See

paragraph 4c of this Appendix).

b. Department of Commerce. The Secretary of Commerce shall,

consistent with guidelines issued by the Director, OMB, develop and

issue standards and guidelines for ensuring the security of

information protected by the Act in automated information systems.

c. The Department of Defense, General Services Administration,

and National Aeronautics and Space Administration. These agencies

shall, consistent with guidelines issued by the Director, OMB,

ensure that instructions are issued on what agencies must do in

order to comply with the requirements of Section (m) of the Act when

contracting for the operation of a system of records to accomplish

an agency purpose.

d. Office of Personnel Management. The Director of the Office of

Personnel Management shall, consistent with guidelines issued by the

Director, OMB:

(1) Develop and maintain government-wide standards and

procedures for civilian personnel information processing and

recordkeeping directives to assure conformance with the Act.

(2) Develop and conduct Privacy Act training programs for agency

personnel, including both the conduct of courses in various

substantive areas (e.g., administrative, information technology) and

the development of materials that agencies can use in their own

courses. The assignment of this responsibility to OPM does not

affect the responsibility of individual agency heads for developing

and conducting training programs tailored to the specific needs of

their own personnel.

e. National Archives and Records Administration. The Archivist

of the United States through the Office of the Federal Register,

shall, consistent with guidelines issued by the Director, OMB:

(1) Issue instructions on the format of the agency notices and

rules required to be published under the Act.

(2) Compile and publish every two years, the rules promulgated

under 5 U.S.C. 552a(f) and agency notices published under 5 U.S.C.

552a(e)(4) in a form available to the public at low cost.

(3) Issue procedures governing the transfer of records to

Federal Records Centers for storage, processing, and servicing

pursuant to 44 U.S.C. 3103. For purposes of the Act, such records

are considered to be maintained by the agency that deposited them.

The Archivist may disclose deposited records only according to the

access rules established by the agency that deposited them.

f. Office of Management and Budget. The Director of the Office

of Management and Budget will:

(1) Issue guidelines and directives to the agencies to implement

the Act.

(2) Assist the agencies, at their request, in implementing their

Privacy Act programs.

(3) Review new and altered system of records and matching

program reports submitted pursuant to Section (o) of the Act.

(4) Compile the biennial report of the President to Congress in

accordance with Section (s) of the Act.

(5) Compile and issue a biennial report on the agencies'

implementation of the computer matching provisions of the Privacy

Act, pursuant to Section (u)(6) of the Act.

4. Reporting Requirements. The Privacy Act requires agencies to

make the following kinds of reports:

----------------------------------------------------------------------------------------------------------------

Report When Due Recipient**

----------------------------------------------------------------------------------------------------------------

Biennial Privacy Act Report.................. June 30, 1996, Administrator, OIRA.

1998, 2000, 2002.

Biennial Matching Activity Report............ June 30, 1996, Administrator, OIRA.

1998, 2000, 2002.

New System of Records Report................. When establishing a Administrator, OIRA, Congress.

system of records--

at least 40 days

before operating

the system*.

Altered System of Records Report............. When adding a new *Administrator, OIRA, Congress.

routine use,

exemption, or

otherwise

significantly

altering an

existing system of

records--at least

40 days before

change to system

takes place.

New Matching Program Report.................. When establishing a Administrator, OIRA, Congress.

new matching

program--at least

40 days before

operating the

program*.

Renewal of Existing Matching Program......... At least 40 days Administrator, OIRA, Congress.

prior to

expiration of any

one year extension

of the original

program--treat as

a new program.

Altered Matching Program..................... When making a Administrator, OIRA, Congress.

significant change

to an existing

matching program--

at least 40 days

before operating

an altered

program*.

Matching Agreements.......................... At least 40 days Congress.

prior to the start

of a matching

program*.

----------------------------------------------------------------------------------------------------------------

*Review Period: Note that the statutory reporting requirement is 30 days prior; the additional ten days will

ensure that OMB and Congress have sufficient time to review the proposal. Agencies should therefore ensure

that reports are mailed expeditiously after being signed.

**Recipient Addresses: At bottom of envelope print ``Privacy Act Report''.

[[Page 6437]]

House of Representatives: The Chair of the House Committee on

Government Reform and Oversight, 2157 RHOB, Washington, D.C. 20515-

6143.

Senate: The Chair of the Senate Committee on Governmental

Affairs, 340 SDOB, Washington, D.C. 20510-6250.

Office of Management and Budget: The Administrator of the Office

of Information and Regulatory Affairs, Office of Management and

Budget, ATTN: Docket Library, NEOB Room 10012, Washington, D.C.

20503.

a. Biennial Privacy Act Report. To provide the necessary

information for the biennial report of the President, agencies shall

submit a biennial report to OMB, covering their Privacy Act

activities for the calendar years covered by the reporting period.

The exact format of the report will be established by OMB. At a

minimum, however, agencies should collect and be prepared to report

the following data on a calendar year basis:

(1) A listing of publication activity during the year showing

the following:

*Total Number of Systems of Records (Exempt/NonExempt)

*Number of New Systems of Records Added (Exempt/NonExempt)

*Number Routine Uses Added

*Number Exemptions Added to Existing Systems

*Number Exemptions Deleted from Existing Systems

*Total Number of Automated Systems of Records (Exempt/NonExempt)

The agency should provide a brief narrative describing those

activities in detail, e.g., ``the Department added a (k)(1)

exemption to an existing system of records entitled ``Investigative

Records of the Office of Investigations;'' or ``the agency added a

new routine use to a system of records entitled `Employee Health

Records' that would permit disclosure of health data to researchers

under contract to the agency to perform workplace risk analysis.''

(2) A brief description of any public comments received on

agency publication and implementation activities, and agency

response.

(3) Number of access and amendment requests from record subjects

citing the Privacy Act that were received during the calendar year

of the report. Also the disposition of requests from any year that

were completed during the calendar year of the report:

*Total Number of Access Requests

Number Granted in Whole

Number Granted in Part

Number Wholly Denied

Number For Which No Record Found

*Total Amendment Requests

Number Granted in Whole

Number Granted in Part

Number Wholly Denied

*Number of Appeals of Denials of Access

Number Granted in Whole

Number Granted in Part

Number Wholly Denied

Number For Which No Record Found

*Number of Appeals of Denials of Amendment

Number Granted in Whole

Number Granted in Part

Number Wholly Denied

(4) Number of instances in which individuals brought suit under

section (g) of the Privacy Act against the agency and the results of

any such litigation that resulted in a change to agency practices or

affected guidance issued by OMB.

(5) Results of the reviews undertaken in response to paragraph

3a of this Appendix.

(6) Description of agency Privacy Act training activities

conducted in accordance with paragraph 3a(6) of this Appendix.

b. Biennial Matching Activity Report (See 5 U.S.C.

552a(u)(3)(D)). At the end of each calendar year, the Data Integrity

Board of each agency that has participated in a matching program

will collect data summarizing that year's matching activity. The Act

requires that such activity be reported every two years. OMB will

establish the exact format of the report, but agencies' Data

Integrity Boards should be prepared to report the data identified

below both to the agency head and to OMB:

(1) A listing of the names and positions of the members of the

Data Integrity Board and showing separately the name of the Board

Secretary, his or her agency mailing address, and telephone number.

Also show and explain any changes in membership or structure

occurring during the reporting year.

(2) A listing of each matching program, by title and purpose, in

which the agency participated during the reporting year. This

listing should show names of participant agencies, give a brief

description of the program, and give a page citation and the date of

the Federal Register notice describing the program.

(3) For each matching program, an indication of whether the

cost/benefit analysis performed resulted in a favorable ratio. The

Data Integrity Board should explain why the agency proceeded with

any matching program for which an unfavorable ratio was reached.

(4) For each program for which the Board waived a cost/benefit

analysis, the reasons for the waiver and the results of the match,

if tabulated.

(5) A description of any matching agreement the Board rejected

and an explanation of the rejection.

(6) A listing of any violations of matching agreements that have

been alleged or identified, and a discussion of any action taken.

(7) A discussion of any litigation involving the agency's

participation in any matching program.

(8) For any litigation based on allegations of inaccurate

records, an explanation of the steps the agency used to ensure the

integrity of its data as well as the verification process it used in

the matching program, including an assessment of the adequacy of

each.

c. New and Altered System of Records Report. The Act requires

agencies to publish notices in the Federal Register describing new

or altered systems of records, and to submit reports to OMB, and to

the Chair of the Committee on Government Reform and Oversight of the

House of Representatives, and the Chair of the Committee on

Governmental Affairs of the Senate. The reports must be transmitted

at least 40 days prior to the operation of the new system of records

or the date on which the alteration to an existing system takes

place.

(1) Which Alterations Require a Report. Minor changes to systems

of records need not be reported. For example, a change in the

designation of the system manager due to a reorganization would not

require a report, so long as an individual's ability to gain access

to his or her records is not affected. Other examples include

changing applicable safeguards as a result of a risk analysis or

deleting a routine use when there is no longer a need for the

disclosure. The following changes are those for which a report is

required:

(a) A significant increase in the number, type, or category of

individuals about whom records are maintained. For example, a system

covering physicians that has been expanded to include other types of

health care providers, e.g., nurses, technicians, etc., would

require a report. Increases attributable to normal growth should not

be reported.

(b) A change that expands the types or categories of information

maintained. For example, a benefit system which originally included

only earned income information that has been expanded to include

unearned income information.

(c) A change that alters the purpose for which the information

is used.

(d) A change to equipment configuration (either hardware or

software) that creates substantially greater access to the records

in the system of records. For example, locating interactive

terminals at regional offices for accessing a system formerly

accessible only at the headquarters would require a report.

(e) The addition of an exemption pursuant to Section (j) or (k)

of the Act. Note that, in examining a rulemaking for a Privacy Act

exemption as part of a report of a new or altered system of records,

OMB will also review the rule under applicable regulatory review

procedures and agencies need not make a separate submission for that

purpose.

(f) The addition of a routine use pursuant to 5 U.S.C.

552a(b)(3).

(2) Reporting Changes to Multiple Systems of Records. When an

agency makes a change to an information technology installation or a

telecommunication network, or makes any other general changes in

information collection, processing, dissemination, or storage that

affect multiple systems of records, it may submit a single,

consolidated report, with changes to existing notices and supporting

documentation included in the submission.

(3) Contents of the New or Altered System Report. The report for

a new or altered system has three elements: a transmittal letter, a

narrative statement, and supporting documentation.

(a) Transmittal Letter. The transmittal letter should be signed

by the senior agency official responsible for implementation of the

Act within the agency and should contain the name and telephone

number of the individual who can best answer questions about the

system of records. The letter should contain the agency's assurance

that the proposed system does not duplicate any existing agency or

government-wide systems of records. The letter sent to OMB may also

include a request for waiver of the time

[[Page 6438]]

period for the review. The agency should indicate why it cannot meet

the established review period and the consequences of not obtaining

the waiver. (See paragraph 4e below.) There is no prescribed format

for the letter.

(b) Narrative Statement. There is also no prescribed format for

the narrative statement, but it should be brief. It should make

reference, as appropriate, to information in the supporting

documentation rather than restating such information. The statement

should:

1. Describe the purpose for which the agency is establishing the

system of records.

2. Identify the authority under which the system of records is

maintained. The agency should avoid citing housekeeping statutes,

but rather cite the underlying programmatic authority for

collecting, maintaining, and using the information. When the system

is being operated to support an agency housekeeping program, e.g., a

carpool locator, the agency may, however, cite a general

housekeeping statute that authorizes the agency head to keep such

records as necessary.

3. Provide the agency's evaluation of the probable or potential

effect of the proposal on the privacy of individuals.

4. Provide a brief description of the steps taken by the agency

to minimize the risk of unauthorized access to the system of

records. A more detailed assessment of the risks and specific

administrative, technical, procedural, and physical safeguards

established shall be made available to OMB upon request.

5. Explain how each proposed routine use satisfies the

compatibility requirement of subsection (a)(7) of the Act. For

altered systems, this requirement pertains only to any newly

proposed routine use.

6. Provide OMB Control Numbers, expiration dates, and titles of

any information collection requests (e.g., forms, surveys, etc.)

contained in the system of records and approved by OMB under the

Paperwork Reduction Act. If the request for OMB clearance of an

information collection is pending, the agency may simply state the

title of the collection and the date it was submitted for OMB

clearance.

(c) Supporting Documentation. Attach the following to all new or

altered system of records reports:

1. A copy of the new or altered system of records notice

consistent with the provisions of 5 U.S.C. 552a(e)(4). The notice

must appear in the format prescribed by the Office of the Federal

Register's Document Drafting Handbook. For proposed altered systems

the agency should supply a copy of the original system of records

notice to ensure that reviewers can understand the changes proposed.

If the sole change to an existing system of records is to add a

routine use, the agency should either republish the entire system of

records notice, a condensed description of the system of records, or

a citation to the last full text Federal Register publication.

2. A copy in Federal Register format of any new exemption rules

or changes to published rules (consistent with the provisions of 5

U.S.C. 552a(f),(j), or (k)) that the agency proposes to issue for

the new or altered system.

(4) OMB Review. OMB will review reports under 5 U.S.C. 552a(r)

and provide comments if appropriate. Agencies may assume that OMB

concurs in the Privacy Act aspects of their proposal if OMB has not

commented within 40 days from the date the transmittal letter was

signed. Agencies should ensure that letters are transmitted

expeditiously after they are signed.

(5) Timing of Systems of Records Reports. Agencies may publish

system of records and routine use notices as well as proposed

exemption rules in the Federal Register at the same time that they

send the new or altered system report to OMB and Congress. The

period for OMB and congressional review and the notice and comment

period for routine uses and exemptions will then run concurrently.

Note that exemptions must be published as final rules before they

are effective.

d. New or Altered Matching Program Report. The Act requires

agencies to publish notices in the Federal Register describing new

or altered matching programs, and to submit reports to OMB, and to

Congress. The report must be received at least 40 days prior to the

initiation of any matching activity carried out under a new or

substantially altered matching program. For renewals of continuing

programs, the report must be dated at least 40 days prior to the

expiration of any existing matching agreement.

(1) When to Report Altered Matching Programs. Agencies need not

report minor changes to matching programs. The term ``minor change

to a matching program'' means a change that does not significantly

alter the terms of the agreement under which the program is being

carried out. Examples of significant changes include:

(a) Changing the purpose for which the program was established.

(b) Changing the matching population, either by including new

categories of record subjects or by greatly increasing the numbers

of records matched.

(c) Changing the legal authority covering the matching program.

(d) Changing the source or recipient agencies involved in the

matching program.

(2) Contents of New or Altered Matching Program Report. The

report for a new or altered matching program has three elements: a

transmittal letter, a narrative statement, and supporting

documentation that includes a copy of the proposed Federal Register

notice.

(a) Transmittal Letter. The transmittal letter should be signed

by the senior agency official responsible for implementation of the

Privacy Act within the agency and should contain the name and

telephone number of the individual who can best answer questions

about the matching program. The letter should state that a copy of

the matching agreement has been distributed to Congress as the Act

requires. The letter to OMB may also include a request for waiver of

the review time period. (See 4e below.)

(b) Narrative Statement. There is no prescribed format for the

narrative statement, but it should be brief. It should make

reference, as appropriate, to information in the supporting

documentation rather than restating such information. The statement

should provide:

1. A description of the purpose of the matching program and the

authority under which it is being carried out.

2. A description of the security safeguards used to protect

against any unauthorized access or disclosure of records used in the

match.

3. If the cost/benefit analysis required by Section (u)(4)(A)

indicated an unfavorable ratio or was waived pursuant to OMB

guidance, an explanation of the basis on which the agency justifies

conducting the match.

(c) Supporting Documentation. Attach the following:

1. A copy of the Federal Register notice describing the

matching program. The notice must appear in the format prescribed by

the Office of the Federal Register's Document Drafting Handbook.

(See 5b (3).)

2. For the Congressional report only, a copy of the matching

agreement.

(3) OMB Review. OMB will review reports under 5 U.S.C. 552a(r)

and provide comments if appropriate. Agencies may assume that OMB

concurs in the Privacy Act aspects of their proposal if OMB has not

commented within 40 days from the date the transmittal letter was

signed.

(4) Timing of Matching Program Reports. Agencies should ensure

that letters are transmitted expeditiously after they are signed.

Agencies may publish matching program notices in the Federal

Register at the same time that they send the matching program report

to OMB and Congress. The period for OMB and congressional review and

the notice and comment period will then run concurrently.

e. Expedited Review. The Director, OMB, may grant a waiver of

the 40-day review period for either systems of records or matching

program reviews. The agency must ask for the waiver in the

transmittal letter and demonstrate compelling reasons. When a waiver

is granted, the agency is not thereby relieved of any other

requirement of the Act. If no waiver is granted, agencies may

presume concurrence at the expiration of the 40 day review period if

OMB has not commented by that time. Note that OMB cannot waive time

periods specifically established by the Act such as the 30 days

notice and comment period required for the adoption of a routine use

proposal pursuant to Section (b)(3) of the Act.

5. Publication Requirements. The Privacy Act requires agencies

to publish notices or rules in the Federal Register in the following

circumstances: when adopting a new or altered system of records,

when adopting a routine use, when adopting an exemption for a system

of records, or when proposing to carry out a new or altered matching

program. (See paragraph 4c(1) and 4d(1) above on what constitutes an

alteration requiring a report to OMB and the Congress.)

a. Publishing New or Altered Systems of Records Notices and

Exemption Rules.

(1) Who Publishes. The agency responsible for operating the

system of records makes the necessary publication. Publication

should be carried out at the departmental or agency level. Even

where a system of records is to

[[Page 6439]]

be operated exclusively by a component, the department rather than the

component should publish the notice. Thus, for example, the

Department of the Treasury would publish a system of records notice

covering a system operated exclusively by the Internal Revenue

Service. Note that if the agency is proposing to exempt the system

under Section (j) or (k) of the Act, it must publish a rule in

addition to the system of records notice.

(a) Government-wide Systems of Records. Certain agencies publish

systems of records containing records for which they have

government-wide responsibilities. The records may be located in

other agencies, but they are being used under the authority of and

in conformance with the rules mandated by the publishing agency. The

Office of Personnel Management, for example, has published a number

of government-wide systems of records relating to the operation of

the government's personnel program. Agencies should not publish

systems of records that wholly or partly duplicate existing

government-wide systems of records.

(b) Section (m) Contract Provisions. When an agency provides by

contract for the operation of a system of records, it should ensure

that a system of records notice describing the system has been

published. It should also review the notice to ensure that it

contains a routine use under Section (e)(4)(D) of the Act permitting

disclosure to the contractor and his or her personnel.

(2) When to Publish.

(a) System Notice. The system of records notice must appear in

the Federal Register before the agency begins to operate the system,

e.g., collect and use the information.

(b) Routine Use. A routine use must be published in the Federal

Register 30 days before the agency discloses records pursuant to its

terms. (Note that the addition of a routine use to an existing

system of records requires a report to OMB and Congress, and that

the review period for this report is 40 days.)

(c) Exemption Rule. A rule exempting a system of records under

(j) or (k) or the Act must be established through informal

rulemaking pursuant to the Administrative Procedure Act. This

process generally requires publication of a proposed rule, a period

during which the public may comment, publication of a final rule,

and the adoption of the final rule. Agencies may not withhold

records under an exemption until these requirements have been met.

(3) Format. Agencies should follow the publication format

contained in the Office of the Federal Register's Document Drafting

Handbook which may be obtained from the Government Printing Office.

b. Publishing Matching Notices.

(1) Who Publishes. Generally, the recipient Federal agency (or

the Federal source agency in a match conducted by a nonfederal

agency) is responsible for publishing in the Federal Register a

notice describing the new or altered matching program. However, in

large, multi-agency matching programs, where the recipient agency is

merely performing the matches, and the benefit accrues to the source

agencies, the partners should assign responsibility for compliance

with the administrative requirements in a fair and reasonable way.

This may mean having the matching agency carry out these

requirements for all parties, having one participant designated to

do so, or having each source agency do so for its own matching

program(s).

(2) Timing. Publication must occur at least 30 days prior to the

initiation of any matching activity carried out under a new or

substantially altered matching program. For renewals of programs

agencies wish to continue past the 30 month period of initial

eligibility (i.e., the initial 18 months plus a one year extension),

publication must occur at least 30 days prior to the expiration of

the existing matching agreement. (But note that a report to OMB and

the Congress is also required with a 40 day review period).

(3) Format. The matching notice shall be in the format

prescribed by the Office of the Federal Register's Document Drafting

Handbook and contain the following information:

(a) The name of the Recipient Agency.

(b) The Name(s) of the Source Agencies.

(c) The beginning and ending dates of the match.

(d) A brief description of the matching program, including its

purpose; the legal authorities authorizing its operation; categories

of individuals involved; and identification of records used,

including name(s) of Privacy Act Systems of records.

(e) The identification, address, and telephone number of a

Recipient Agency official who will answer public inquiries about the

program.

Appendix II to OMB Circular No. A-130--Cost Accounting, Cost Recovery,

and Interagency Sharing of Information Technology Facilities

[The guidance formerly found in Appendix II has been revised and

placed in Section 8b. See, Transmittal No. 2, 59 FR 37906. Appendix

II has been deleted and is reserved for future topics.]

Appendix III to OMB Circular No. A-130--Security of Federal Automated

Information Resources

A. Requirements

1. Purpose

This Appendix establishes a minimum set of controls to be

included in Federal automated information security programs; assigns

Federal agency responsibilities for the security of automated

information; and links agency automated information security

programs and agency management control systems established in

accordance with OMB Circular No. A-123. The Appendix revises

procedures formerly contained in Appendix III to OMB Circular No. A-

130 (50 FR 52730; December 24, 1985), and incorporates requirements

of the Computer Security Act of 1987 (P.L. 100-235) and

responsibilities assigned in applicable national security

directives.

2. Definitions

The term:

a. ``Adequate security'' means security commensurate with the

risk and magnitude of the harm resulting from the loss, misuse, or

unauthorized access to or modification of information. This includes

assuring that systems and applications used by the agency operate

effectively and provide appropriate confidentiality, integrity, and

availability, through the use of cost-effective management,

personnel, operational, and technical controls.

b. ``Application'' means the use of information resources

(information and information technology) to satisfy a specific set

of user requirements.

c. ``General support system'' or ``system'' means an

interconnected set of information resources under the same direct

management control which shares common functionality. A system

normally includes hardware, software, information, data,

applications, communications, and people. A system can be, for

example, a local area network (LAN) including smart terminals that

supports a branch office, an agency-wide backbone, a communications

network, a departmental data processing center including its

operating system and utilities, a tactical radio network, or a

shared information processing service organization (IPSO).

d. ``Major application'' means an application that requires

special attention to security due to the risk and magnitude of the

harm resulting from the loss, misuse, or unauthorized access to or

modification of the information in the application. Note: All

Federal applications require some level of protection. Certain

applications, because of the information in them, however, require

special management oversight and should be treated as major.

Adequate security for other applications should be provided by

security of the systems in which they operate.

3. Automated Information Security Programs. Agencies shall

implement and maintain a program to assure that adequate security is

provided for all agency information collected, processed,

transmitted, stored, or disseminated in general support systems and

major applications.

Each agency's program shall implement policies, standards and

procedures which are consistent with government-wide policies,

standards, and procedures issued by the Office of Management and

Budget, the Department of Commerce, the General Services

Administration and the Office of Personnel Management (OPM).

Different or more stringent requirements for securing national

security information should be incorporated into agency programs as

required by appropriate national security directives. At a minimum,

agency programs shall include the following controls in their

general support systems and major applications:

a. Controls for general support systems.

(1) Assign Responsibility for Security. Assign responsibility

for security in each system to an individual knowledgeable in the

information technology used in the system and in providing security

for such technology.

(2) System Security Plan. Plan for adequate security of each

general support system as part of the organization's information

resources management (IRM) planning process. The security plan shall

be consistent

[[Page 6440]]

with guidance issued by the National Institute of Standards and

Technology (NIST). Independent advice and comment on the security

plan shall be solicited prior to the plan's implementation. A

summary of the security plans shall be incorporated into the

strategic IRM plan required by the Paperwork Reduction Act (44

U.S.C. Chapter 35) and Section 8(b) of this circular. Security plans

shall include:

(a) Rules of the System. Establish a set of rules of behavior

concerning use of, security in, and the acceptable level of risk

for, the system. The rules shall be based on the needs of the

various users of the system. The security required by the rules

shall be only as stringent as necessary to provide adequate security

for information in the system. Such rules shall clearly delineate

responsibilities and expected behavior of all individuals with

access to the system. They shall also include appropriate limits on

interconnections to other systems and shall define service provision

and restoration priorities. Finally, they shall be clear about the

consequences of behavior not consistent with the rules.

(b) Training. Ensure that all individuals are appropriately

trained in how to fulfill their security responsibilities before

allowing them access to the system. Such training shall assure that

employees are versed in the rules of the system, be consistent with

guidance issued by NIST and OPM, and apprise them about available

assistance and technical security products and techniques. Behavior

consistent with the rules of the system and periodic refresher

training shall be required for continued access to the system.

(c) Personnel Controls. Screen individuals who are authorized to

bypass significant technical and operational security controls of

the system commensurate with the risk and magnitude of harm they

could cause. Such screening shall occur prior to an individual being

authorized to bypass controls and periodically thereafter.

(d) Incident Response Capability. Ensure that there is a

capability to provide help to users when a security incident occurs

in the system and to share information concerning common

vulnerabilities and threats. This capability shall share information

with other organizations, consistent with NIST coordination, and

should assist the agency in pursuing appropriate legal action,

consistent with Department of Justice guidance.

(e) Continuity of Support. Establish and periodically test the

capability to continue providing service within a system based upon

the needs and priorities of the participants of the system.

(f) Technical Security. Ensure that cost-effective security

products and techniques are appropriately used within the system.

(g) System Interconnection. Obtain written management

authorization, based upon the acceptance of risk to the system,

prior to connecting with other systems. Where connection is

authorized, controls shall be established which are consistent with

the rules of the system and in accordance with guidance from NIST.

(3) Review of Security Controls. Review the security controls in

each system when significant modifications are made to the system,

but at least every three years. The scope and frequency of the

review should be commensurate with the acceptable level of risk for

the system. Depending on the potential risk and magnitude of harm

that could occur, consider identifying a deficiency pursuant to OMB

Circular No. A-123, ``Management Accountability and Control'' and

the Federal Managers' Financial Integrity Act (FMFIA), if there is

no assignment of security responsibility, no security plan, or no

authorization to process for a system.

(4) Authorize Processing. Ensure that a management official

authorizes in writing the use of each general support system based

on implementation of its security plan before beginning or

significantly changing processing in the system. Use of the system

shall be re-authorized at least every three years.

b. Controls for Major Applications.

(1) Assign Responsibility for Security. Assign responsibility

for security of each major application to a management official

knowledgeable in the nature of the information and process supported

by the application and in the management, personnel, operational,

and technical controls used to protect it. This official shall

assure that effective security products and techniques are

appropriately used in the application and shall be contacted when a

security incident occurs concerning the application.

(2) Application Security Plan. Plan for the adequate security of

each major application, taking into account the security of all

systems in which the application will operate. The plan shall be

consistent with guidance issued by NIST. Advice and comment on the

plan shall be solicited from the official responsible for security

in the primary system in which the application will operate prior to

the plan's implementation. A summary of the security plans shall be

incorporated into the strategic IRM plan required by the Paperwork

Reduction Act. Application security plans shall include:

(a) Application Rules. Establish a set of rules concerning use

of and behavior within the application. The rules shall be as

stringent as necessary to provide adequate security for the

application and the information in it. Such rules shall clearly

delineate responsibilities and expected behavior of all individuals

with access to the application. In addition, the rules shall be

clear about the consequences of behavior not consistent with the

rules.

(b) Specialized Training. Before allowing individuals access to

the application, ensure that all individuals receive specialized

training focused on their responsibilities and the application

rules. This may be in addition to the training required for access

to a system. Such training may vary from a notification at the time

of access (e.g., for members of the public using an information

retrieval application) to formal training (e.g., for an employee

that works with a high-risk application).

(c) Personnel Security. Incorporate controls such as separation

of duties, least privilege and individual accountability into the

application and application rules as appropriate. In cases where

such controls cannot adequately protect the application or

information in it, screen individuals commensurate with the risk and

magnitude of the harm they could cause. Such screening shall be done

prior to the individuals' being authorized to access the application

and periodically thereafter.

(d) Contingency Planning. Establish and periodically test the

capability to perform the agency function supported by the

application in the event of failure of its automated support.

(e) Technical Controls. Ensure that appropriate security

controls are specified, designed into, tested, and accepted in the

application in accordance with appropriate guidance issued by NIST.

(f) Information Sharing. Ensure that information shared from the

application is protected appropriately, comparable to the protection

provided when information is within the application.

(g) Public Access Controls. Where an agency's application

promotes or permits public access, additional security controls

shall be added to protect the integrity of the application and the

confidence the public has in the application. Such controls shall

include segregating information made directly accessible to the

public from official agency records.

(3) Review of Application Controls. Perform an independent

review or audit of the security controls in each application at

least every three years. Consider identifying a deficiency pursuant

to OMB Circular No. A-123, ``Management Accountability and Control''

and the Federal Managers' Financial Integrity Act if there is no

assignment of responsibility for security, no security plan, or no

authorization to process for the application.

(4) Authorize Processing. Ensure that a management official

authorizes in writing use of the application by confirming that its

security plan as implemented adequately secures the application.

Results of the most recent review or audit of controls shall be a

factor in management authorizations. The application must be

authorized prior to operating and re-authorized at least every three

years thereafter. Management authorization implies accepting the

risk of each system used by the application.

4. Assignment of Responsibilities

a. Department of Commerce. The Secretary of Commerce shall:

(1) Develop and issue appropriate standards and guidance for the

security of sensitive information in Federal computer systems.

(2) Review and update guidelines for training in computer

security awareness and accepted computer security practice, with

assistance from OPM.

(3) Provide agencies guidance for security planning to assist in

their development of application and system security plans.

(4) Provide guidance and assistance, as appropriate, to agencies

concerning cost-effective controls when interconnecting with other

systems.

(5) Coordinate agency incident response activities to promote

sharing of incident response information and related

vulnerabilities.

[[Page 6441]]

(6) Evaluate new information technologies to assess their

security vulnerabilities, with technical assistance from the

Department of Defense, and apprise Federal agencies of such

vulnerabilities as soon as they are known.

b. Department of Defense. The Secretary of Defense shall:

(1) Provide appropriate technical advice and assistance

(including work products) to the Department of Commerce.

(2) Assist the Department of Commerce in evaluating the

vulnerabilities of emerging information technologies.

c. Department of Justice. The Attorney General shall:

(1) Provide appropriate guidance to agencies on legal remedies

regarding security incidents and ways to report and work with law

enforcement concerning such incidents.

(2) Pursue appropriate legal actions when security incidents

occur.

d. General Services Administration. The Administrator of General

Services shall:

(1) Provide guidance to agencies on addressing security

considerations when acquiring automated data processing equipment

(as defined in section 111(a)(2) of the Federal Property and

Administrative Services Act of 1949, as amended).

(2) Facilitate the development of contract vehicles for agencies

to use in the acquisition of cost-effective security products and

services (e.g., back-up services).

(3) Provide appropriate security services to meet the needs of

Federal agencies to the extent that such services are cost-

effective.

e. Office of Personnel Management. The Director of the Office of

Personnel Management shall:

(1) Assure that its regulations concerning computer security

training for Federal civilian employees are effective.

(2) Assist the Department of Commerce in updating and

maintaining guidelines for training in computer security awareness

and accepted computer security practice.

f. Security Policy Board. The Security Policy Board shall

coordinate the activities of the Federal government regarding the

security of information technology that processes classified

information in accordance with applicable national security

directives;

5. Correction of Deficiencies and Reports

a. Correction of Deficiencies. Agencies shall correct

deficiencies which are identified through the reviews of security

for systems and major applications described above.

b. Reports on Deficiencies. In accordance with OMB Circular No.

A-123, ``Management Accountability and Control'', if a deficiency in

controls is judged by the agency head to be material when weighed

against other agency deficiencies, it shall be included in the

annual FMFIA report. Less significant deficiencies shall be reported

and progress on corrective actions tracked at the appropriate agency

level.

c. Summaries of Security Plans. Agencies shall include a summary

of their system security plans and major application plans in the

strategic plan required by the Paperwork Reduction Act (44 U.S.C.

3506).

B. Descriptive Information

The following descriptive language is explanatory. It is

included to assist in understanding the requirements of the

Appendix.

The Appendix re-orients the Federal computer security program to

better respond to a rapidly changing technological environment. It

establishes government-wide responsibilities for Federal computer

security and requires Federal agencies to adopt a minimum set of

management controls. These management controls are directed at

individual information technology users in order to reflect the

distributed nature of today's technology.

For security to be most effective, the controls must be part of

day-to-day operations. This is best accomplished by planning for

security not as a separate activity, but as an integral part of

overall planning.

``Adequate security'' is defined as ``security commensurate with

the risk and magnitude of harm resulting from the loss, misuse, or

unauthorized access to or modification of information.'' This

definition explicitly emphasizes the risk-based policy for cost-

effective security established by the Computer Security Act.

The Appendix no longer requires the preparation of formal risk

analyses. In the past, substantial resources have been expended

doing complex analyses of specific risks to systems, with limited

tangible benefit in terms of improved security for the systems.

Rather than continue to try to precisely measure risk, security

efforts are better served by generally assessing risks and taking

actions to manage them. While formal risk analyses need not be

performed, the need to determine adequate security will require that

a risk-based approach be used. This risk assessment approach should

include a consideration of the major factors in risk management: the

value of the system or application, threats, vulnerabilities, and

the effectiveness of current or proposed safeguards. Additional

guidance on effective risk assessment is available in ``An

Introduction to Computer Security: The NIST Handbook'' (March 16,

1995).

Discussion of the Appendix's Major Provisions. The following

discussion is provided to aid reviewers in understanding the changes

in emphasis in the Appendix.

Automated Information Security Programs. Agencies are required

to establish controls to assure adequate security for all

information processed, transmitted, or stored in Federal automated

information systems. This Appendix emphasizes management controls

affecting individual users of information technology. Technical and

operational controls support management controls. To be effective,

all must interrelate. For example, authentication of individual

users is an important management control, for which password

protection is a technical control. However, password protection will

only be effective if both a strong technology is employed, and it is

managed to assure that it is used correctly.

Four controls are set forth: assigning responsibility for

security, security planning, periodic review of security controls,

and management authorization. The Appendix requires that these

management controls be applied in two areas of management

responsibility: one for general support systems and one for major

applications.

The terms ``general support system'' and ``major application''

were used in OMB Bulletins Nos. 88-16 and 90-08. A general support

system is ``an interconnected set of information resources under the

same direct management control which shares common functionality.''

Such a system can be, for example, a local area network (LAN)

including smart terminals that supports a branch office, an agency-

wide backbone, a communications network, a departmental data

processing center including its operating system and utilities, a

tactical radio network, or a shared information processing service

organization. Normally, the purpose of a general support system is

to provide processing or communications support.

A major application is a use of information and information

technology to satisfy a specific set of user requirements that

requires special management attention to security due to the risk

and magnitude of harm resulting from the loss, misuse or

unauthorized access to or modification of the information in the

application. All applications require some level of security, and

adequate security for most of them should be provided by security of

the general support systems in which they operate. However, certain

applications, because of the nature of the information in them,

require special management oversight and should be treated as major.

Agencies are expected to exercise management judgement in

determining which of their applications are major.

The focus of OMB Bulletins Nos. 88-16 and 90-08 was on

identifying and securing both general support systems and

applications which contained sensitive information. The Appendix

requires the establishment of security controls in all general

support systems, under the presumption that all contain some

sensitive information, and focuses extra security controls on a

limited number of particularly high-risk or major applications.

a. General Support Systems. The following controls are required

in all general support systems:

(1) Assign Responsibility for Security. For each system, an

individual should be a focal point for assuring there is adequate

security within the system, including ways to prevent, detect, and

recover from security problems. That responsibility should be

assigned in writing to an individual trained in the technology used

in the system and in providing security for such technology,

including the management of security controls such as user

identification and authentication.

(2) Security Plan. The Computer Security Act requires that

security plans be developed for all Federal computer systems that

contain sensitive information. Given the expansion of distributed

processing since passage of the Act, the presumption in the Appendix

is that all general support systems contain some sensitive

information which requires protection to assure its integrity,

availability, or confidentiality, and therefore all systems require

security plans.

[[Page 6442]]

Previous guidance on security planning was contained in OMB

Bulletin No. 90-08. This Appendix supersedes OMB Bulletin 90-08 and

expands the coverage of security plans from Bulletin 90-08 to

include rules of individual behavior as well as technical security.

Consistent with OMB Bulletin 90-08, the Appendix directs NIST to

update and expand security planning guidance and issue it as a

Federal Information Processing Standard (FIPS). In the interim,

agencies should continue to use the Appendix of OMB Bulletin No. 90-

08 as guidance for the technical portion of their security plans.

The Appendix continues the requirement that independent advice

and comment on the security plan for each system be sought. The

intent of this requirement is to improve the plans, foster

communication between managers of different systems, and promote the

sharing of security expertise.

This Appendix also continues the requirement from the Computer

Security Act that summaries of security plans be included in agency

strategic information resources management plans. OMB will provide

additional guidance about the contents of those strategic plans,

pursuant to the Paperwork Reduction Act of 1995.

The following specific security controls should be included in

the security plan for a general support system:

(a) Rules. An important new requirement for security plans is

the establishment of a set of rules of behavior for individual users

of each general support system. These rules should clearly delineate

responsibilities of and expectations for all individuals with access

to the system. They should be consistent with system-specific policy

as described in ``An Introduction to Computer Security: The NIST

Handbook'' (March 16, 1995). In addition, they should state the

consequences of non-compliance. The rules should be in writing and

will form the basis for security awareness and training.

The development of rules for a system must take into

consideration the needs of all parties who use the system. Rules

should be as stringent as necessary to provide adequate security.

Therefore, the acceptable level of risk for the system must be

established and should form the basis for determining the rules.

Rules should cover such matters as work at home, dial-in access,

connection to the Internet, use of copyrighted works, unofficial use

of government equipment, the assignment and limitation of system

privileges, and individual accountability. Often rules should

reflect technical security controls in the system. For example,

rules regarding password use should be consistent with technical

password features in the system. Rules may be enforced through

administrative sanctions specifically related to the system (e.g.

loss of system privileges) or through more general sanctions as are

imposed for violating other rules of conduct. In addition, the rules

should specifically address restoration of service as a concern of

all users of the system.

(b) Training. The Computer Security Act requires Federal

agencies to provide for the mandatory periodic training in computer

security awareness and accepted computer security practice of all

employees who are involved with the management, use or operation of

a Federal computer system within or under the supervision of the

Federal agency. This includes contractors as well as employees of

the agency. Access provided to members of the public should be

constrained by controls in the applications through which access is

allowed, and training should be within the context of those

controls. The Appendix enforces such mandatory training by requiring

its completion prior to granting access to the system. Each new user

of a general support system in some sense introduces a risk to all

other users. Therefore, each user should be versed in acceptable

behavior--the rules of the system--before being allowed to use the

system. Training should also inform the individual how to get help

in the event of difficulty with using or security of the system.

Training should be tailored to what a user needs to know to use

the system securely, given the nature of that use. Training may be

presented in stages, for example as more access is granted. In some

cases, the training should be in the form of classroom instruction.

In other cases, interactive computer sessions or well-written and

understandable brochures may be sufficient, depending on the risk

and magnitude of harm.

Over time, attention to security tends to dissipate. In

addition, changes to a system may necessitate a change in the rules

or user procedures. Therefore, individuals should periodically have

refresher training to assure that they continue to understand and

abide by the applicable rules.

To assist agencies, the Appendix requires NIST, with assistance

from the Office of Personnel Management (OPM), to update its

existing guidance. It also proposes that OPM assure that its rules

for computer security training for Federal civilian employees are

effective.

(c) Personnel Controls. It has long been recognized that the

greatest harm has come from authorized individuals engaged in

improper activities, whether intentional or accidental. In every

general support system, a number of technical, operational, and

management controls are used to prevent and detect harm. Such

controls include individual accountability, ``least privilege,'' and

separation of duties.

Individual accountability consists of holding someone

responsible for his or her actions. In a general support system,

accountability is normally accomplished by identifying and

authenticating users of the system and subsequently tracing actions

on the system to the user who initiated them. This may be done, for

example, by looking for patterns of behavior by users.

Least privilege is the practice of restricting a user's access

(to data files, to processing capability, or to peripherals) or type

of access (read, write, execute, delete) to the minimum necessary to

perform his or her job.

Separation of duties is the practice of dividing the steps in a

critical function among different individuals. For example, one

system programmer can create a critical piece of operating system

code, while another authorizes its implementation. Such a control

keeps a single individual from subverting a critical process.

Nevertheless, in some instances, individuals may be given the

ability to bypass some significant technical and operational

controls in order to perform system administration and maintenance

functions (e.g., LAN administrators or systems programmers).

Screening such individuals in positions of trust will supplement

technical, operational, and management controls, particularly where

the risk and magnitude of harm is high.

(d) Incident Response Capability. Security incidents, whether

caused by viruses, hackers, or software bugs, are becoming more

common. When faced with a security incident, an agency should be

able to respond in a manner that both protects its own information

and helps to protect the information of others who might be affected

by the incident. To address this concern, agencies should establish

formal incident response mechanisms. Awareness and training for

individuals with access to the system should include how to use the

system's incident response capability.

To be fully effective, incident handling must also include

sharing information concerning common vulnerabilities and threats

with those in other systems and other agencies. The Appendix directs

agencies to effectuate such sharing, and tasks NIST to coordinate

those agency activities government-wide.

The Appendix also directs the Department of Justice to provide

appropriate guidance on pursuing legal remedies in the case of

serious incidents.

(e) Continuity of Support. Inevitably, there will be service

interruptions. Agency plans should assure that there is an ability

to recover and provide service sufficient to meet the minimal needs

of users of the system. Manual procedures are generally NOT a viable

back-up option. When automated support is not available, many

functions of the organization will effectively cease. Therefore, it

is important to take cost-effective steps to manage any disruption

of service.

Decisions on the level of service needed at any particular time

and on priorities in service restoration should be made in

consultation with the users of the system and incorporated in the

system rules. Experience has shown that recovery plans that are

periodically tested are substantially more viable than those that

are not. Moreover, untested plans may actually create a false sense

of security.

(f) Technical Security. Agencies should assure that each system

appropriately uses effective security products and techniques,

consistent with standards and guidance from NIST. Often such

techniques will correspond with system rules of behavior, such as in

the proper use of password protection.

The Appendix directs NIST to continue to issue computer security

guidance to assist agencies in planning for and using technical

security products and techniques. Until such guidance is issued,

however, the planning guidance included in OMB Bulletin 90-08 can

assist in determining techniques for

[[Page 6443]]

effective security in a system and in addressing technical controls in

the security plan.

(g) System Interconnection. In order for a community to

effectively manage risk, it must control access to and from other

systems. The degree of such control should be established in the

rules of the system and all participants should be made aware of any

limitations on outside access. Technical controls to accomplish this

should be put in place in accordance with guidance issued by NIST.

There are varying degrees of how connected a system is. For

example, some systems will choose to isolate themselves, others will

restrict access such as allowing only e-mail connections or remote

access only with sophisticated authentication, and others will be

fully open. The management decision to interconnect should be based

on the availability and use of technical and non-technical

safeguards and consistent with the acceptable level of risk defined

in the system rules.

(3) Review of Security Controls. The security of a system will

degrade over time, as the technology evolves and as people and

procedures change. Reviews should assure that management,

operational, personnel, and technical controls are functioning

effectively. Security controls may be reviewed by an independent

audit or a self review. The type and rigor of review or audit should

be commensurate with the acceptable level of risk that is

established in the rules for the system and the likelihood of

learning useful information to improve security. Technical tools

such as virus scanners, vulnerability assessment products (which

look for known security problems, configuration errors, and the

installation of the latest patches), and penetration testing can

assist in the on-going review of different facets of systems.

However, these tools are no substitute for a formal management

review at least every three years. Indeed, for some high-risk

systems with rapidly changing technology, three years will be too

long.

Depending upon the risk and magnitude of harm that could result,

weaknesses identified during the review of security controls should

be reported as deficiencies in accordance with OMB Circular No. A-

123, ``Management Accountability and Control'' and the Federal

Managers' Financial Integrity Act. In particular, if a basic

management control such as assignment of responsibility, a workable

security plan, or management authorization are missing, then

consideration should be given to identifying a deficiency.

(4) Authorize Processing. The authorization of a system to

process information, granted by a management official, provides an

important quality control (some agencies refer to this authorization

as accreditation). By authorizing processing in a system, a manager

accepts the risk associated with it. Authorization is not a decision

that should be made by the security staff.

Both the security official and the authorizing management

official have security responsibilities. In general, the security

official is closer to the day-to-day operation of the system and

will direct or perform security tasks. The authorizing official will

normally have general responsibility for the organization supported

by the system.

Management authorization should be based on an assessment of

management, operational, and technical controls. Since the security

plan establishes the security controls, it should form the basis for

the authorization, supplemented by more specific studies as needed.

In addition, the periodic review of controls should also contribute

to future authorizations. Some agencies perform ``certification

reviews'' of their systems periodically. These formal technical

evaluations lead to a management accreditation, or ``authorization

to process.'' Such certifications (such as those using the

methodology in FIPS Pub 102 ``Guideline for Computer Security

Certification and Accreditation'') can provide useful information to

assist management in authorizing a system, particularly when

combined with a review of the broad behavioral controls envisioned

in the security plan required by the Appendix.

Re-authorization should occur prior to a significant change in

processing, but at least every three years. It should be done more

often where there is a high risk and potential magnitude of harm.

b. Controls in Major Applications. Certain applications require

special management attention due to the risk and magnitude of harm

that could occur. For such applications, the controls of the support

system(s) in which they operate are likely to be insufficient.

Therefore, additional controls specific to the application are

required. Since the function of applications is the direct

manipulation and use of information, controls for securing

applications should emphasize protection of information and the way

it is manipulated.

(1) Assign Responsibility for Security. By definition, major

applications are high risk and require special management attention.

Major applications usually support a single agency function and

often are supported by more than one general support system. It is

important, therefore, that an individual be assigned responsibility

in writing to assure that the particular application has adequate

security. To be effective, this individual should be knowledgeable

in the information and process supported by the application and in

the management, personnel, operational, and technical controls used

to protect the application.

(2) Application Security Plans. Security for each major

application should be addressed by a security plan specific to the

application. The plan should include controls specific to protecting

information and should be developed from the application manager's

perspective. To assist in assuring its viability, the plan should be

provided to the manager of the primary support system which the

application uses for advice and comment. This recognizes the

critical dependence of the security of major applications on the

underlying support systems they use. Summaries of application

security plans should be included in strategic information resource

management plans in accordance with this Circular.

(a) Application Rules. Rules of behavior should be established

which delineate the responsibilities and expected behavior of all

individuals with access to the application. The rules should state

the consequences of inconsistent behavior. Often the rules will be

associated with technical controls implemented in the application.

Such rules should include, for example, limitations on changing

data, searching databases, or divulging information.

(b) Specialized Training. Training is required for all

individuals given access to the application, including members of

the public. It should vary depending on the type of access allowed

and the risk that access represents to the security of the

application and information in it. This training will be in addition

to that required for access to a support system.

(c) Personnel Security. For most major applications, management

controls such as individual accountability requirements, separation

of duties enforced by access controls, or limitations on the

processing privileges of individuals, are generally more cost-

effective personnel security controls than background screening.

Such controls should be implemented as both technical controls and

as application rules. For example, technical controls to ensure

individual accountability, such as looking for patterns of user

behavior, are most effective if users are aware that there is such a

technical control. If adequate audit or access controls (through

both technical and non-technical methods) cannot be established,

then it may be cost-effective to screen personnel, commensurate with

the risk and magnitude of harm they could cause. The change in

emphasis on screening in the Appendix should not affect background

screening deemed necessary because of other duties that an

individual may perform.

(d) Contingency Planning. Normally the Federal mission supported

by a major application is critically dependent on the application.

Manual processing is generally NOT a viable back-up option. Managers

should plan for how they will perform their mission and/or recover

from the loss of existing application support, whether the loss is

due to the inability of the application to function or a general

support system failure. Experience has demonstrated that testing a

contingency plan significantly improves its viability. Indeed,

untested plans or plans not tested for a long period of time may

create a false sense of ability to recover in a timely manner.

(e) Technical Controls. Technical security controls, for example

tests to filter invalid entries, should be built into each

application. Often these controls will correspond with the rules of

behavior for the application. Under the previous Appendix,

application security was focused on the process by which sensitive,

custom applications were developed. While that process is not

addressed in detail in this Appendix, it remains an effective method

for assuring that security controls are built into applications.

Additionally, the technical security controls defined in OMB

Bulletin No. 90-08 will continue, until that guidance is replaced by

NIST's security planning guidance.

(f) Information Sharing. Assure that information which is shared

with Federal

[[Page 6444]]

organizations, State and local governments, and the private sector is

appropriately protected comparable to the protection provided when

the information is within the application. Controls on the

information may stay the same or vary when the information is shared

with another entity. For example, the primary user of the

information may require a high level of availability while the

secondary user does not, and can therefore relax some of the

controls designed to maintain the availability of the information.

At the same time, however, the information shared may require a

level of confidentiality that should be extended to the secondary

user. This normally requires notification and agreement to protect

the information prior to its being shared.

(g) Public Access Controls. Permitting public access to a

Federal application is an important method of improving information

exchange with the public. At the same time, it introduces risks to

the Federal application. To mitigate these risks, additional

controls should be in place as appropriate. These controls are in

addition to controls such as ``firewalls'' that are put in place for

security of the general support system.

In general, it is more difficult to apply conventional controls

to public access systems, because many of the users of the system

may not be subject to individual accountability policies. In

addition, public access systems may be a target for mischief because

of their higher visibility and published access methods.

Official records need to be protected against loss or

alteration. Official records in electronic form are particularly

susceptible since they can be relatively easy to change or destroy.

Therefore, official records should be segregated from information

made directly accessible to the public. There are different ways to

segregate records. Some agencies and organizations are creating

dedicated information dissemination systems (such as bulletin boards

or World Wide Web servers) to support this function. These systems

can be on the outside of secure gateways which protect internal

agency records from outside access.

In order to secure applications that allow direct public access,

conventional techniques such as least privilege (limiting the

processing capability as well as access to data) and integrity

assurances (such as checking for viruses, clearly labeling the age

of data, or periodically spot checking data) should also be used.

Additional guidance on securing public access systems is available

from NIST Computer Systems Laboratory Bulletin ``Security Issues in

Public Access Systems'' (May, 1993).

(3) Review of Application Controls. At least every three years,

an independent review or audit of the security controls for each

major application should be performed. Because of the higher risk

involved in major applications, the review or audit should be

independent of the manager responsible for the application. Such

reviews should verify that responsibility for the security of the

application has been assigned, that a viable security plan for the

application is in place, and that a manager has authorized the

processing of the application. A deficiency in any of these controls

should be considered a deficiency pursuant to the Federal Manager's

Financial Integrity Act and OMB Circular No. A-123, ``Management

Accountability and Control.''

The review envisioned here is different from the system test and

certification process required in the current Appendix. That

process, however, remains useful for assuring that technical

security features are built into custom-developed software

applications. While the controls in that process are not

specifically called for in this Appendix, they remain in Bulletin

No. 90-08, and are recommended in appropriate circumstances as

technical controls.

(4) Authorize Processing. A major application should be

authorized by the management official responsible for the function

supported by the application at least every three years, but more

often where the risk and magnitude of harm is high. The intent of

this requirement is to assure that the senior official whose mission

will be adversely affected by security weaknesses in the application

periodically assesses and accepts the risk of operating the

application. The authorization should be based on the application

security plan and any review(s) performed on the application. It

should also take into account the risks from the general support

systems used by the application.

4. Assignment of Responsibilities. The Appendix assigns

government-wide responsibilities to agencies that are consistent

with their missions and the Computer Security Act.

a. Department of Commerce. The Department of Commerce, through

NIST, is assigned the following responsibilities consistent with the

Computer Security Act.

(1) Develop and issue security standards and guidance.

(2) Review and update, with assistance from OPM, the guidelines

for security training issued in 1988 pursuant to the Computer

Security Act to assure they are effective.

(3) Replace and update the technical planning guidance in the

appendix to OMB Bulletin 90-08 This should include guidance on

effective risk-based security absent a formal risk analysis.

(4) Provide agencies with guidance and assistance concerning

effective controls for systems when interconnecting with other

systems, including the Internet. Such guidance on, for example, so-

called ``firewalls'' is becoming widely available and is critical to

agencies as they consider how to interconnect their communications

capabilities.

(5) Coordinate agency incident response activities. Coordination

of agency incident response activities should address both threats

and vulnerabilities as well as improve the ability of the Federal

government for rapid and effective cooperation in response to

serious security breaches.

(6) Assess security vulnerabilities in new information

technologies and apprise Federal agencies of such vulnerabilities.

The intent of this new requirement is to help agencies understand

the security implications of technology before they purchase and

field it. In the past, there have been too many instances where

agencies have acquired and implemented technology, then found out

about vulnerabilities in the technology and had to retrofit security

measures. This activity is intended to help avoid such difficulties

in the future.

b. Department of Defense. The Department, through the National

Security Agency, should provide technical advice and assistance to

NIST, including work products such as technical security guidelines,

which NIST can draw upon for developing standards and guidelines for

protecting sensitive information in Federal computers.

Also, the Department, through the National Security Agency,

should assist NIST in evaluating vulnerabilities in emerging

technologies. Such vulnerabilities may present a risk to national

security information as well as to unclassified information.

c. Department of Justice. The Department of Justice should

provide appropriate guidance to Federal agencies on legal remedies

available to them when serious security incidents occur. Such

guidance should include ways to report incidents and cooperate with

law enforcement.

In addition, the Department should pursue appropriate legal

actions on behalf of the Federal government when serious security

incidents occur.

d. General Services Administration. The General Services

Administration should provide agencies guidance for addressing

security considerations when acquiring information technology

products or services. This continues the current requirement.

In addition, where cost-effective to do so, GSA should establish

government-wide contract vehicles for agencies to use to acquire

certain security services. Such vehicles already exist for providing

system back-up support and conducting security analyses.

GSA should also provide appropriate security services to assist

Federal agencies to the extent that provision of such services is

cost-effective. This includes providing, in conjunction with the

Department of Defense and the Department of Commerce, appropriate

services which support Federal use of the National Information

Infrastructure (e.g., use of digital signature technology).

e. Office of Personnel Management. In accordance with the

Computer Security Act, OPM should review its regulations concerning

computer security training and assure that they are effective.

In addition, OPM should assist the Department of Commerce in the

review and update of its computer security awareness and training

guidelines. OPM worked closely with NIST in developing the current

guidelines and should work with NIST in revising those guidelines.

f. Security Policy Board. The Security Policy Board is assigned

responsibility for national security policy coordination in

accordance with the appropriate Presidential directive. This

includes policy for the security of information technology used to

process classified information.

Circular A-130 and this Appendix do not apply to information

technology that supports certain critical national security

[[Page 6445]]

missions, as defined in 44 U.S.C. 3502 (9) and 10 U.S.C. 2315. Policy

and procedural requirements for the security of national security

systems (telecommunications and information systems that contain

classified information or that support those critical national

security missions (44 U.S.C. 3502 (9) and 10 U.S.C. 2315)) is

assigned to the Department of Defense pursuant to Presidential

directive. The Circular clarifies that information classified for

national security purposes should also be handled in accordance with

appropriate national security directives. Where classified

information is required to be protected by more stringent security

requirements, those requirements should be followed rather than the

requirements of this Appendix.

5. Reports. The Appendix requires agencies to provide two

reports to OMB:

The first is a requirement that agencies report security

deficiencies and material weaknesses within their FMFIA reporting

mechanisms as defined by OMB Circular No. A-123, ``Management

Accountability and Control,'' and take corrective actions in

accordance with that directive.

The second, defined by the Computer Security Act, requires that

a summary of agency security plans be included in the information

resources management plan required by the Paperwork Reduction Act.

Appendix IV to OMB Circular No. A-130--Analysis of Key Sections

1. Purpose

The purpose of this Appendix is to provide a general context and

explanation for the contents of the key Sections of the Circular.

2. Background

The Paperwork Reduction Act (PRA) of 1980, Public Law 96-511, as

amended by the Paperwork Reduction Act of 1995, Public Law 104-13,

codified at Chapter 35 of Title 44 of the United States Code,

establishes a broad mandate for agencies to perform their

information activities in an efficient, effective, and economical

manner. Section 3504 of the Act provides authority to the Director,

OMB, to develop and implement uniform and consistent information

resources management policies; oversee the development and promote

the use of information management principles, standards, and

guidelines; evaluate agency information management practices in

order to determine their adequacy and efficiency, and determine

compliance of such practices with the policies, principles,

standards, and guidelines promulgated by the Director.

The Circular implements OMB authority under the PRA with respect

to Section 3504(b), general information resources management policy,

Section 3504(d), information dissemination, Section 3504(f), records

management, Section 3504(g), privacy and security, and Section

3504(h), information technology. The Circular also implements

certain provisions of the Privacy Act of 1974 (5 U.S.C. 552a); the

Chief Financial Officers Act (31 U.S.C. 3512 et seq.); Sections 111

and 206 of the Federal Property and Administrative Services Act of

1949, as amended (40 U.S.C. 759 and 487, respectively); the Computer

Security Act (40 U.S.C. 759 note); the Budget and Accounting Act of

1921 (31 U.S.C. 1 et seq.); and Executive Order No. 12046 of March

27, 1978, and Executive Order No. 12472 of April 3, 1984, Assignment

of National Security and Emergency Telecommunications Functions. The

Circular complements 5 CFR Part 1320, Controlling Paperwork Burden

on the Public, which implements other Sections of the PRA dealing

with controlling the reporting and recordkeeping burden placed on

the public.

In addition, the Circular revises and consolidates policy and

procedures in seven previous OMB directives and rescinds those

directives, as follows:

A-3--Government Publications.

A-71--Responsibilities for the Administration and Management of

Automatic Data Processing Activities Transmittal Memorandum No. 1 to

Circular No. A-71--Security of Federal Automated Information

Systems.

A-90--Cooperating with State and Local Governments to Coordinate

and Improve Information Systems.

A-108--Responsibilities for the Maintenance of Records about

Individuals by Federal Agencies

A-114--Management of Federal Audiovisual Activities

A-121--Cost Accounting, Cost Recovery, and Interagency Sharing

of Data Processing Facilities

3. Analysis

Section 6, Definitions. Access and Dissemination. The original

Circular No. A-130 distinguished between the terms ``access to

information'' and ``dissemination of information'' in order to

separate statutory requirements from policy considerations. The

first term means giving members of the public, at their request,

information to which they are entitled by a law such as the FOIA.

The latter means actively distributing information to the public at

the initiative of the agency. The distinction appeared useful at the

time Circular No. A-130 was written, because it allowed OMB to focus

discussion on Federal agencies' responsibilities for actively

distributing information. However, popular usage and evolving

technology have blurred differences between the terms ``access'' and

``dissemination'' and readers of the Circular were confused by the

distinction. For example, if an agency ``disseminates'' information

via an on-line computer system, one speaks of permitting users to

``access'' the information, and on-line ``access'' becomes a form of

``dissemination.''

Thus, the revision defines only the term ``dissemination.''

Special considerations based on access statutes such as the Privacy

Act and the FOIA are explained in context.

Government Information. The definition of ``government

information'' includes information created, collected, processed,

disseminated, or disposed of both by and for the Federal Government.

This recognizes the increasingly distributed nature of information

in electronic environments. Many agencies, in addition to collecting

information for government use and for dissemination to the public,

require members of the public to maintain information or to disclose

it to the public. Sound information resources management dictates

that agencies consider the costs and benefits of a full range of

alternatives to meet government objectives. In some cases, there is

no need for the government actually to collect the information

itself, only to assure that it is made publicly available. For

example, banks insured by the FDIC must provide statements of

financial condition to bank customers on request. Particularly when

information is available in electronic form, networks make the

physical location of information increasingly irrelevant.

The inclusion of information created, collected, processed,

disseminated, or disposed of for the Federal Government in the

definition of ``government information'' does not imply that

responsibility for implementing the provisions of the Circular

itself extends beyond the executive agencies to other entities. Such

an interpretation would be inconsistent with Section 4,

Applicability, and with existing law. For example, the courts have

held that requests to Federal agencies for release of information

under the FOIA do not always extend to those performing information

activities under grant or contract to a Federal agency. Similarly,

grantees may copyright information where the government may not.

Thus the information responsibilities of grantees and contractors

are not identical to those of Federal agencies except to the extent

that the agencies make them so in the underlying grants or

contracts. Similarly, agency information resources management

responsibilities do not extend to other entities.

Information Dissemination Product. This notice defines the term

``information dissemination product'' to include all information

that is disseminated by Federal agencies. While the provision of

access to on-line databases and search software included on compact

disk, read-only memory (CD-ROM) are often called information

services rather than products, there is no clear distinction and,

moreover, no real difference for policy purposes between the two.

Thus, the term ``information dissemination product'' applies to both

products and services, and makes no distinction based on how the

information is delivered.

Section 8a(1). Information Management Planning. Parallel to new

Section 7, Basic Considerations and Assumptions, Section 8a begins

with information resources management planning. Planning is the

process of establishing a course of action to achieve desired

results with available resources. Planners translate organizational

missions into specific goals and, in turn, into measurable

objectives.

The PRA introduced the concept of information resources

management and the principle of information as an institutional

resource which has both value and associated costs. Information

resources management is a tool that managers use to achieve agency

objectives. Information resources management is successful if it

enables managers to achieve agency objectives efficiently and

effectively.

Information resources management planning is an integral part of

overall mission

[[Page 6446]]

planning. Agencies need to plan from the outset for the steps in the

information life cycle. When creating or collecting information,

agencies must plan how they will process and transmit the

information, how they will use it, how they will protect its

integrity, what provisions they will make for access to it, whether

and how they will disseminate it, how they will store and retrieve

it, and finally, how the information will ultimately be disposed of.

They must also plan for the effects their actions and programs will

have on the public and State and local governments.

The Role of State and Local Governments. OMB made additions at

Sections 7a, 7e, and 7j, Basic Considerations and Assumptions,

concerning State and local governments, and also in policy

statements at Sections 8a(1)(c), (3)(f), (5)(d)(iii), and (8)(e).

State and local governments, and tribal governments, cooperate

as major partners with the Federal Government in the collection,

processing, and dissemination of information. For example, State

governments are the principal collectors and/or producers of

information in the areas of health, welfare, education, labor

markets, transportation, the environment, and criminal justice.

The States supply the Federal Government with data on aid to

families with dependent children; medicare; school enrollments,

staffing, and financing; statistics on births, deaths, and

infectious diseases; population related data that form the basis for

national estimates; employment and labor market data; and data used

for census geography. National information resources are greatly

enhanced through these major cooperating efforts.

Federal agencies need to be sensitive to the role of State and

local governments, and tribal governments, in managing information

and in managing information technology. When planning, designing,

and carrying out information collectio

This text is long and has been trimmed here. Open the source document for the complete record.