![](media/image1.jpeg){width="5.997222222222222in"
height="3.922222222222222in"}

**A SUMMARY GUIDE:**

**PUBLIC LAW, EXECUTIVE ORDERS, AND POLICY DOCUMENTS**

November 13, 2001

Department of the Treasury

Deputy Assistant Secretary (Information Systems) /CIO

Office of Security

ACKNOWLEDGEMENT

# 

This document was derived from Appendix D of the Department of Defense
Office of the Joint Chiefs of Staff publication "Information Assurance:
Legal, Regulatory, Policy and Organizational Considerations", Fourth
Edition, August 1999.

FOREWARD

This *Summary Guide* contains summaries of public law, executive orders,
national policies, and Department of the Treasury policies relevant to
information assurance (IA). The documents are grouped according to
issuing organization and listed in chronological order. Summaries of
public law, except as noted, summarize the original act, with coverage
of any subsequent amendment(s). It is not intended to be a complete
compendium of all regulations. There are many more not listed in this
document. The document attempts to list the most important.

TABLE OF CONTENTS

###### Section Page

PUBLIC LAW [1](#public-law)

1.1 P.L. 73-416, Communications Act of 1934, 19 June 1934
[1](#p.l.-73-416-communications-act-of-1934-19-june-1934)

1.2 P.L. 93-579, Privacy Act of 1974, 31 December 1974
[1](#p.l.-93-579-privacy-act-of-1974-31-december-1974)

1.3 P.L. 95-511, Foreign Intelligence Surveillance Act of 1978, 25
October 1978
[1](#p.l.-95-511-foreign-intelligence-surveillance-act-of-1978-25-october-1978)

1.4 P.L. 99-474, Computer Fraud and Abuse Act of 1986.
[2](#p.l.-99-474-computer-fraud-and-abuse-act-of-1986.)

1.5 P.L. 99-508, Electronic Communications Privacy Act of 1986, 21
October 1986
[2](#p.l.-99-508-electronic-communications-privacy-act-of-1986-21-october-1986)

1.6 P.L. 100-235, Computer Security Act of 1987, 8 January 1988
[2](#p.l.-100-235-computer-security-act-of-1987-8-january-1988)

1.7 P.L. 103-62, Government Performance and Results Act of 1993, 3
August 1993
[3](#p.l.-103-62-government-performance-and-results-act-of-1993-3-august-1993)

1.8 P.L. 104-13, Paperwork Reduction Acts of 1980, 1995, 22 May 1995
[3](#p.l.-104-13-paperwork-reduction-acts-of-1980-1995-22-may-1995)

1.9 P.L. 104-104, Telecommunications Act of 1996/Communications Decency
Act of 1996, 8 February 1996
[4](#p.l.-104-104-telecommunications-act-of-1996communications-decency-act-of-1996-8-february-1996)

1.10 P.L. 104-106, Information Technology Management Reform Act of 1996,
National Defense Authorization Act for Fiscal Year 1996 (Clinger-Cohen
Act), 10 February 1996
[4](#p.l.-104-106-information-technology-management-reform-act-of-1996-national-defense-authorization-act-for-fiscal-year-1996-clinger-cohen-act-10-february-1996)

1.11 P.L. 104-201, National Defense Authorization Act for Fiscal Year
1997, 23 September, 1996
[5](#p.l.-104-201-national-defense-authorization-act-for-fiscal-year-1997-23-september-1996)

1.12 5 USC 552, Freedom of Information Act (FOIA) of 1974, as amended by
P.L. 104-231, Electronic Freedom of Information Act of 1996, 2 October
1996
[5](#usc-552-freedom-of-information-act-foia-of-1974-as-amended-by-p.l.-104-231-electronic-freedom-of-information-act-of-1996-2-october-1996)

1.13 P.L. 104 - 294, Title I, Economic Espionage Act of 1996, 11 October
1996
[6](#p.l.-104---294-title-i-economic-espionage-act-of-1996-11-october-1996)

1.14 P.L. 104-294, Title II, National Infrastructure Protection Act of
1996, 11 October, 1996
[6](#p.l.-104-294-title-ii-national-infrastructure-protection-act-of-1996-11-october-1996)

1.15 44 USC 3504, Government Paperwork Elimination Act
[7](#usc-3504-government-paperwork-elimination-act)

1.16 P.L. 105-220, Section 508 Accessibility, 7 August 1998
[7](#p.l.-105-220-section-508-accessibility-7-august-1998)

1.17 P.L. 106-398, National Defense Authorization Act, Fiscal Year 2001
Title X Subtitle G, Government Information Security Reform Act, 30
October 2000
[7](#p.l.-106-398-national-defense-authorization-act-fiscal-year-2001-title-x-subtitle-g-government-information-security-reform-act-30-october-2000)

EXECUTIVE ORDERS [8](#executive-orders)

2.1 Executive Office of the President, Executive Order 12333, United
States Intelligence Activities, The White House, Washington DC, 4
December 1981
[8](#executive-office-of-the-president-executive-order-12333-united-states-intelligence-activities-the-white-house-washington-dc-4-december-1981)

2.2 Executive Office of the President, Executive Order 12472, Assignment
of National Security and Emergency Preparedness Telecommunications
Functions, The White House, Washington D.C., 3 April 1984
[8](#executive-office-of-the-president-executive-order-12472-assignment-of-national-security-and-emergency-preparedness-telecommunications-functions-the-white-house-washington-d.c.-3-april-1984)

2.3 Executive Office of the President, Executive Order 12958, Classified
National Security Information, The White House, Washington D.C., 17
April 1995
[9](#executive-office-of-the-president-executive-order-12958-classified-national-security-information-the-white-house-washington-d.c.-17-april-1995)

2.4 Executive Office of the President, Executive Order 13010, Critical
Infrastructure Protection, The White House, Washington D.C., 15 July
1996
[10](#executive-office-of-the-president-executive-order-13010-critical-infrastructure-protection-the-white-house-washington-d.c.-15-july-1996)

2.5 Executive Office of the President, Executive Order 13011, Federal
Information Technology, The White House, Washington D.C., 16 July 1996
[12](#executive-office-of-the-president-executive-order-13011-federal-information-technology-the-white-house-washington-d.c.-16-july-1996)

2.6 E.O., Computer Software Piracy, 1 October 1998
[12](#e.o.-computer-software-piracy-1-october-1998)

2.7 E.O. 13228, Establishing the Office of Homeland Security and the
Homeland Security Council, 8 October 2001
[12](#e.o.-13228-establishing-the-office-of-homeland-security-and-the-homeland-security-council-8-october-2001)

2.8 E.O. 13231, Critical Infrastructure Protection in the Information
Age, 16 October 2001
[13](#e.o.-13231-critical-infrastructure-protection-in-the-information-age-16-october-2001)

OTHER NATIONAL POLICY [14](#other-national-policy)

3.1 Presidential/National Security Directives
[14](#presidentialnational-security-directives)

3.1.1 PD/NSC 24, Telecommunications Protection Policy (U), 16 November
1977 (Partially declassified/released on 18 February 1994)
[14](#pdnsc-24-telecommunications-protection-policy-u-16-november-1977-partially-declassifiedreleased-on-18-february-1994)

3.1.2 NSD 42, National Policy for the Security of National Security
Telecommunications and Information Systems, 5 July 1990
[14](#nsd-42-national-policy-for-the-security-of-national-security-telecommunications-and-information-systems-5-july-1990)

3.1.3 PDD/NSC 29, Security Policy Coordination, 16 September 1994
[15](#pddnsc-29-security-policy-coordination-16-september-1994)

3.1.4 PDD 39, Secret, U.S. Policy on Counterterrorism, 1996
[16](#pdd-39-secret-u.s.-policy-on-counterterrorism-1996)

3.1.5 PDD 62, Combating Terrorism, 22 May 1998
[16](#pdd-62-combating-terrorism-22-may-1998)

3.1.6 PDD 63, Protecting America\'s Critical Infrastructures, 22 May
1998
[17](#pdd-63-protecting-americas-critical-infrastructures-22-may-1998)

3.1.7 NSPD-1, Organization of the National Security System, 13 February
2001
[17](#nspd-1-organization-of-the-national-security-system-13-february-2001)

3.2 Office of Management and Budget
[18](#office-of-management-and-budget)

3.2.1 Office of Management and Budget, OMB Circular A-76, \"Performance
of Commercial Activities,\" Executive Office of the President,
Publication Services, 4 August 1983
[18](#office-of-management-and-budget-omb-circular-a-76-performance-of-commercial-activities-executive-office-of-the-president-publication-services-4-august-1983)

3.2.2 Office of Management and Budget, OMB Circular A-123, Management
Accountability and Control, Executive Office of the President,
Publication Services, 21 June 1995
[19](#office-of-management-and-budget-omb-circular-a-123-management-accountability-and-control-executive-office-of-the-president-publication-services-21-june-1995)

3.2.3 Office of Management and Budget, Supplement to OMB Circular A-76,
\"Performance of Commercial Activities,\" Executive Office of the
President, Publication Services, 8 February 1996
[19](#office-of-management-and-budget-supplement-to-omb-circular-a-76-performance-of-commercial-activities-executive-office-of-the-president-publication-services-8-february-1996)

3.2.4 M-99-18, Privacy Policies on Federal Web Sites, 2 June 1999
[20](#m-99-18-privacy-policies-on-federal-web-sites-2-june-1999)

3.2.5 Office of Management and Budget, OMB Circular A-127, Financial
Management Systems, Executive Office of the President, Publication
Services, 23 July 1993, Transmittal Memorandum #2, 10 June 1999.
[20](#office-of-management-and-budget-omb-circular-a-127-financial-management-systems-executive-office-of-the-president-publication-services-23-july-1993-transmittal-memorandum-2-10-june-1999.)

3.2.6 M-99-20, Security of Federal Automated Information Resources, 23
June 1999
[20](#m-99-20-security-of-federal-automated-information-resources-23-june-1999)

3.2.7 M-00-07, Incorporating and Funding Security in Information Systems
Investments, 28 February 2000
[21](#m-00-07-incorporating-and-funding-security-in-information-systems-investments-28-february-2000)

3.2.8 M-00-10, OMB Procedures and Guidance on Implementing the
Government Paperwork Elimination Act, 25 April 2000
[21](#m-00-10-omb-procedures-and-guidance-on-implementing-the-government-paperwork-elimination-act-25-april-2000)

3.2.9 M-00-13, Privacy Policies and Data Collection on Federal Web
Sites, 22 June 2000
[21](#m-00-13-privacy-policies-and-data-collection-on-federal-web-sites-22-june-2000)

3.2.10 Office of Management and Budget, OMB Circular A-130, Management
of Federal Information Resources, Executive Office of the President,
Publication Services, November 2000
[22](#office-of-management-and-budget-omb-circular-a-130-management-of-federal-information-resources-executive-office-of-the-president-publication-services-november-2000)

3.2.11 M-01-08, Guidance on Implementing the Government Information
Security Reform Act, 16 January 2001
[22](#m-01-08-guidance-on-implementing-the-government-information-security-reform-act-16-january-2001)

3.2.12 M-01-24, Reporting Instructions for the Government Information
Security Reform Act, 22 June 2001
[23](#m-01-24-reporting-instructions-for-the-government-information-security-reform-act-22-june-2001)

3.2.13 Office of Management and Budget, OMB Circular A-11, Preparing and
Submitting Budget Estimates, Executive Office of the President,
Publication Services, 17 July 2001
[23](#office-of-management-and-budget-omb-circular-a-11-preparing-and-submitting-budget-estimates-executive-office-of-the-president-publication-services-17-july-2001)

3.2.14 M-02-01, Guidance for Preparing and Submitting Security Plans of
Action and Milestones, 17 October 2001
[23](#m-02-01-guidance-for-preparing-and-submitting-security-plans-of-action-and-milestones-17-october-2001)

3.3 National Institute of Standards and Technology
[24](#national-institute-of-standards-and-technology)

3.3.1 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 73, Guidelines for Security of
Computer Applications, 30 June 1980
[24](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-73-guidelines-for-security-of-computer-applications-30-june-1980)

3.3.2 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 87, Guidelines for Contingency
Planning, 27 March 1981
[24](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-87-guidelines-for-contingency-planning-27-march-1981)

3.3.3 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 81, DES Modes of Operation, 2
December 1980 with change notice 20 November 1981
[24](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-81-des-modes-of-operation-2-december-1980-with-change-notice-20-november-1981)

3.3.4 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 102, Guideline for Computer
Security Certification and Accreditation, 27 September 1983
[24](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-102-guideline-for-computer-security-certification-and-accreditation-27-september-1983)

3.3.5 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 112, Password Usage, 30 May 1985
[24](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-112-password-usage-30-may-1985)

3.3.6 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 180-1, Secure Hash Standard
(SHS), 11 May 1993
[25](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-180-1-secure-hash-standard-shs-11-may-1993)

3.3.7 National Institute of Standards and Technology, NIST Special
Publication 800-12, An Introduction to Computer Security: The NIST
Handbook, October 1995
[25](#national-institute-of-standards-and-technology-nist-special-publication-800-12-an-introduction-to-computer-security-the-nist-handbook-october-1995)

3.3.8 National Institute of Standards and Technology, NIST Special
Publication 800-13, Telecommunications Security Guidelines for
Telecommunications Management Network, October 1995
[25](#national-institute-of-standards-and-technology-nist-special-publication-800-13-telecommunications-security-guidelines-for-telecommunications-management-network-october-1995)

3.3.9 National Institute of Standards and Technology, NIST Special
Publication 800-14, Generally Accepted Principles and Practices for
Security Information Technology Systems, September 1996
[25](#national-institute-of-standards-and-technology-nist-special-publication-800-14-generally-accepted-principles-and-practices-for-security-information-technology-systems-september-1996)

3.3.10 National Institute of Standards and Technology, NIST Special
Publication 800-16, Information Technology Security Training
Requirements: A Role- and Performance-Based Model, April 1998
[26](#national-institute-of-standards-and-technology-nist-special-publication-800-16-information-technology-security-training-requirements-a-role--and-performance-based-model-april-1998)

3.3.11 National Institute of Standards and Technology, NIST Special
Publication 800-18, Guide for Developing Security Plans for Information
Technology Systems, December 1998
[26](#national-institute-of-standards-and-technology-nist-special-publication-800-18-guide-for-developing-security-plans-for-information-technology-systems-december-1998)

3.3.12 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 46-3, Data Encryption Standard
(DES), 25 October 1999
[26](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-46-3-data-encryption-standard-des-25-october-1999)

3.3.13 National Institute of Standards and Technology, NIST Special
Publication 800-21, Guideline for Implementing Cryptography in the
Federal Government, November 1999
[26](#national-institute-of-standards-and-technology-nist-special-publication-800-21-guideline-for-implementing-cryptography-in-the-federal-government-november-1999)

3.3.14 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 186-2, Digital Signature Standard
(DSS), 15 February 2000
[26](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-186-2-digital-signature-standard-dss-15-february-2000)

3.3.15 National Institute of Standards and Technology, NIST Special
Publication 800-23, Guidelines to Federal Organizations on Security
Assurance and Acquisition/Use of Tested/Evaluated Products, August 2000
[27](#national-institute-of-standards-and-technology-nist-special-publication-800-23-guidelines-to-federal-organizations-on-security-assurance-and-acquisitionuse-of-testedevaluated-products-august-2000)

3.3.16 National Institute of Standards and Technology (NIST), NIST
Special Publication 800-25, Federal Agency Use of Public Key Technology
for Digital Signatures and Authentication, October 2000
[27](#national-institute-of-standards-and-technology-nist-nist-special-publication-800-25-federal-agency-use-of-public-key-technology-for-digital-signatures-and-authentication-october-2000)

3.3.17 National Institute of Standards and Technology (NIST), NIST
Special Publication 800-32, Introduction to Public Key Technology and
the Federal PKI Infrastructure, February 2001
[27](#national-institute-of-standards-and-technology-nist-nist-special-publication-800-32-introduction-to-public-key-technology-and-the-federal-pki-infrastructure-february-2001)

3.3.18 National Institute of Standards and Technology (NIST), NIST
Special Publication 800-24, PBX Vulnerability Analysis: Finding Holes in
Your PBX Before Someone Else Does, April 2001
[27](#national-institute-of-standards-and-technology-nist-nist-special-publication-800-24-pbx-vulnerability-analysis-finding-holes-in-your-pbx-before-someone-else-does-april-2001)

3.3.19 National Institute of Standards and Technology (NIST), NIST
Special Publication 800-27, Engineering Principles for Information
Technology Security (A Baseline for Achieving Security), June 2001
[28](#national-institute-of-standards-and-technology-nist-nist-special-publication-800-27-engineering-principles-for-information-technology-security-a-baseline-for-achieving-security-june-2001)

3.3.20 National Institute of Standards and Technology, NIST Special
Publication 800-26, Security Self-Assessment Guide for Information
Technology Systems, August 2001
[28](#national-institute-of-standards-and-technology-nist-special-publication-800-26-security-self-assessment-guide-for-information-technology-systems-august-2001)

3.3.21 National Institute of Standards and Technology (NIST), NIST
Special Publication 800-31, Intrusion Detection Systems (IDS), August
2001
[28](#national-institute-of-standards-and-technology-nist-nist-special-publication-800-31-intrusion-detection-systems-ids-august-2001)

3.3.22 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) 140-2, Security Requirements for
Cryptographic Modules, 25 May 2001 with change notice 1, 10 October 2001
[28](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-140-2-security-requirements-for-cryptographic-modules-25-may-2001-with-change-notice-1-10-october-2001)

3.3.23 National Institute of Standards and Technology, Federal
Information Processing Standard (FIPS) XXX, Advanced Encryption Standard
(AES), Draft
[29](#national-institute-of-standards-and-technology-federal-information-processing-standard-fips-xxx-advanced-encryption-standard-aes-draft)

3.4 National Security Telecommunications and Information Systems
Security Committee (NSTISSC)
[29](#national-security-telecommunications-and-information-systems-security-committee-nstissc)

3.4.1 NCSC-1, National Policy For Safeguarding and Control of
Communications Security Material, 16 January 1981
[29](#ncsc-1-national-policy-for-safeguarding-and-control-of-communications-security-material-16-january-1981)

3.4.2 NCSC-5 w/ App 1 and 2, National Policy on Use of Cryptomaterial by
Activities Operating in High Risk Environments, 16 January 1981
[29](#ncsc-5-w-app-1-and-2-national-policy-on-use-of-cryptomaterial-by-activities-operating-in-high-risk-environments-16-january-1981)

3.4.3 NCSC-8, Confidential, National Policy on Securing Voice
Communications (U), 7 May 1982
[30](#ncsc-8-confidential-national-policy-on-securing-voice-communications-u-7-may-1982)

3.4.4 NCSC-2, National Policy on Release of Communications Security
Information to U.S. Contractors and Other U.S. Nongovernmental Sources,
7 July 1983
[30](#ncsc-2-national-policy-on-release-of-communications-security-information-to-u.s.-contractors-and-other-u.s.-nongovernmental-sources-7-july-1983)

3.4.5 NTISSP No 1, National Policy on Application of Communications
Security to U.S. Civil and Commercial Space Systems, 17 June 1985
[30](#ntissp-no-1-national-policy-on-application-of-communications-security-to-u.s.-civil-and-commercial-space-systems-17-june-1985)

3.4.6 NTISSP No 200, National Policy on Controlled Access Protection, 15
July 1987
[30](#ntissp-no-200-national-policy-on-controlled-access-protection-15-july-1987)

3.4.7 NSTISSP No 100, Confidential, National Policy on Application of
Communications Security to Command Destruct Systems (U), 17 February
1988
[31](#nstissp-no-100-confidential-national-policy-on-application-of-communications-security-to-command-destruct-systems-u-17-february-1988)

3.4.8 NSTISSD No. 501, National Training Program for Information Systems
Security (INFOSEC) Professionals, 16 November 1992
[31](#nstissd-no.-501-national-training-program-for-information-systems-security-infosec-professionals-16-november-1992)

3.4.9 NSTISSD No. 502, National Security Telecommunications and
Automated Information Systems Security, 5 February 1993
[31](#nstissd-no.-502-national-security-telecommunications-and-automated-information-systems-security-5-february-1993)

3.4.10 NSTISSI No. 7000, Confidential NOFORN, TEMPEST Countermeasures
for Facilities (U), 29 November 1993
[31](#nstissi-no.-7000-confidential-noforn-tempest-countermeasures-for-facilities-u-29-november-1993)

3.4.11 NSTISSP No. 6, National Policy on Certification and Accreditation
of National Security Telecommunications and Information Systems, 8 April
1994
[31](#nstissp-no.-6-national-policy-on-certification-and-accreditation-of-national-security-telecommunications-and-information-systems-8-april-1994)

3.4.12 NSTISSI No. 4011, National Training Standard for Information
Systems Security (INFOSEC) Professionals, 20 June 1994
[32](#nstissi-no.-4011-national-training-standard-for-information-systems-security-infosec-professionals-20-june-1994)

3.4.13 NSTISSP No. 7, National Policy on Secure Electronic Messaging
Services, 21 February 1995
[32](#nstissp-no.-7-national-policy-on-secure-electronic-messaging-services-21-february-1995)

3.4.14 NSTISSI No. 4012, National Training Standard for Designated
Approving Authority (DAA), August 1997
[32](#nstissi-no.-4012-national-training-standard-for-designated-approving-authority-daa-august-1997)

3.4.15 NSTISSI No. 4013, National Training Standard for System
Administrators in Information Systems Security (INFOSEC), August 1997
[33](#nstissi-no.-4013-national-training-standard-for-system-administrators-in-information-systems-security-infosec-august-1997)

3.4.16 NSTISSI No. 4014, National Training Standard for Information
Systems Security Officers (ISSO), August 1997
[34](#nstissi-no.-4014-national-training-standard-for-information-systems-security-officers-isso-august-1997)

3.2.17 NSTISSP No. 11, National Policy Governing the Acquisition of
Information Assurance (IA) and IA-Enabled Information Technology (IT)
Products, January 2000
[35](#nstissp-no.-11-national-policy-governing-the-acquisition-of-information-assurance-ia-and-ia-enabled-information-technology-it-products-january-2000)

3.4.18 NSTISSI No. 1000, National Information Assurance Certification
and Accreditation Process (NIACAP), April 2000
[35](#nstissi-no.-1000-national-information-assurance-certification-and-accreditation-process-niacap-april-2000)

3.4.19 NSTISSI No. 4009, National Information Systems Security Glossary,
September 2000
[35](#nstissi-no.-4009-national-information-systems-security-glossary-september-2000)

3.4.20 NSTISSI 4015, National Training Standard for System Certifiers,
December 2000
[35](#nstissi-4015-national-training-standard-for-system-certifiers-december-2000)

FEDERAL CIO COUNCIL [36](#federal-cio-council)

4.1 Best Practices: Privacy*,* Internal Revenue Service Model
Information Technology PRIVACY IMPACT ASSESSMENT, 25 February 2000
[36](#best-practices-privacy-internal-revenue-service-model-information-technology-privacy-impact-assessment-25-february-2000)

4.2 Memorandum to Chief Information Officers of all Agencies, Agency
Interaction with GSA's Federal Computer Incident Response Capability
(FedCIRC), 29 October 2000
[36](#memorandum-to-chief-information-officers-of-all-agencies-agency-interaction-with-gsas-federal-computer-incident-response-capability-fedcirc-29-october-2000)

4.3 National Institute of Standards and Technology for the Security,
Privacy and Critical Infrastructure Committee, Federal Information
Technology Security Assessment Framework, 28 November 2000
[36](#national-institute-of-standards-and-technology-for-the-security-privacy-and-critical-infrastructure-committee-federal-information-technology-security-assessment-framework-28-november-2000)

DEPARTMENT OF THE TREASURY [38](#department-of-the-treasury)

5.1 Treasury Directives [38](#treasury-directives)

5.1.1 TD P 85-03, Risk Assessment Guideline, June 1990
[38](#td-p-85-03-risk-assessment-guideline-june-1990)

5.1.2 Treasury Directive 71-10, Department of the Treasury Security
Manual, 23 August 1999
[38](#treasury-directive-71-10-department-of-the-treasury-security-manual-23-august-1999)

5.1.3 TD P 80-05, Records and Information Management Manual, September
1999
[38](#td-p-80-05-records-and-information-management-manual-september-1999)

5.1.4 Treasury Directive 80-05, Records and Information Management
Program, 23 February 2000
[38](#treasury-directive-80-05-records-and-information-management-program-23-february-2000)

5.1.5 Treasury Directive 81-01, Treasury Information Technology (IT)
Programs, 13 April 2000
[38](#treasury-directive-81-01-treasury-information-technology-it-programs-13-april-2000)

5.1.6 Treasury Directive 74-14, Treasury Telework and Flexiplace
Program, 18 October 2000
[39](#treasury-directive-74-14-treasury-telework-and-flexiplace-program-18-october-2000)

5.1.7 TD P 71-10, Department of the Treasury Security Manual, 16 January
1992 plus Transmittal notices through 9 April 2001
[39](#td-p-71-10-department-of-the-treasury-security-manual-16-january-1992-plus-transmittal-notices-through-9-april-2001)

5.1.8 Treasury Directive 87-05, Electronic Commerce Initiatives, 21
April 2001
[39](#treasury-directive-87-05-electronic-commerce-initiatives-21-april-2001)

5.1.9 Treasury Directive 87-04, Personal Use of Government Office
Equipment Including Information Technology, 17 May 2001
[39](#treasury-directive-87-04-personal-use-of-government-office-equipment-including-information-technology-17-may-2001)

5.1.10 TD P 81-01, Information Technology Manual, 16 August 2001
[39](#td-p-81-01-information-technology-manual-16-august-2001)

5.2 Treasury Memoranda [40](#treasury-memoranda)

5.2.1 Office of the CIO Memorandum Subject: Managing Internet Access, 28
April 1995
[40](#office-of-the-cio-memorandum-subject-managing-internet-access-28-april-1995)

5.2.2 Office of the CIO Memorandum Subject: Internet Service Policy and
Procedures for the Treasury Internet Gateway, 7 July 1995
[40](#office-of-the-cio-memorandum-subject-internet-service-policy-and-procedures-for-the-treasury-internet-gateway-7-july-1995)

5.2.3 Office of the CIO Memorandum Subject: Interim Policy Guidance, 23
June 1999
[40](#office-of-the-cio-memorandum-subject-interim-policy-guidance-23-june-1999)

5.2.4 Office of the CIO Memorandum Subject: Guidance on Audit Log
Retention Periods, 30 October 2000
[40](#office-of-the-cio-memorandum-subject-guidance-on-audit-log-retention-periods-30-october-2000)

5.2.5 Office of the CIO Memorandum Subject: Guidance for Systems
Security Plans, 30 October 2000
[40](#office-of-the-cio-memorandum-subject-guidance-for-systems-security-plans-30-october-2000)

5.2.6 Office of the CIO Memorandum Subject: Interim Policy on Product
Assurance, 27 December 2000
[40](#office-of-the-cio-memorandum-subject-interim-policy-on-product-assurance-27-december-2000)

5.2.7 Office of the CIO Memorandum Subject: Protection of Laptop
Computers, 15 February 2001
[41](#office-of-the-cio-memorandum-subject-protection-of-laptop-computers-15-february-2001)

5.2.8 Office of the CIO Memorandum Subject: Interim Policy on Personal
E-mail Accounts, 9 October 2001
[41](#office-of-the-cio-memorandum-subject-interim-policy-on-personal-e-mail-accounts-9-october-2001)

5.3 Other Treasury Documents [41](#other-treasury-documents)

5.3.1 Treasury Chief Information Officer Council, Treasury Enterprise
Architecture Framework, July 2000
[41](#treasury-chief-information-officer-council-treasury-enterprise-architecture-framework-july-2000)

5.3.2 Internal Revenue Service Treasury Information Security Assessment
Framework, May 2001
[41](#internal-revenue-service-treasury-information-security-assessment-framework-may-2001)

5.3.3 Department of the Treasury, DASIS/Chief Information Officer,
Office of Security, Security Classification Guide for the Department of
the Treasury's Critical Information Assets Associated with Project
Matrix, July 2001
[41](#department-of-the-treasury-dasischief-information-officer-office-of-security-security-classification-guide-for-the-department-of-the-treasurys-critical-information-assets-associated-with-project-matrix-july-2001)

Other [42](#other)

6.1 Code of Federal Regulations (CFR)
[42](#code-of-federal-regulations-cfr)

6.2 General Accounting Office [42](#general-accounting-office)

6.2.1 General Accounting Office, GAO/AIMD-98-68, Executive Guide:
Information Security Management Learning from Leading Organizations, May
1998
[42](#general-accounting-office-gaoaimd-98-68-executive-guide-information-security-management-learning-from-leading-organizations-may-1998)

6.2.2 General Accounting Office, GAO/AIMD-00-33, Information Security
Risk Assessment Practices of Leading Organizations, November 1999
[42](#general-accounting-office-gaoaimd-00-33-information-security-risk-assessment-practices-of-leading-organizations-november-1999)

6.2.3 General Accounting Office, GAO/AIMD-12.19.6, Federal Information
System Controls Audit Manual: Volume 1 Financial Statement Audits, June
2001
[43](#general-accounting-office-gaoaimd-12.19.6-federal-information-system-controls-audit-manual-volume-1-financial-statement-audits-june-2001)

6.3 International Standard ISO/IEC 15408, Evaluation Criteria for
Information Technology Security/Common Criteria for Information
Technology Security Evaluation version 2.1, 1 December 1999
[43](#international-standard-isoiec-15408-evaluation-criteria-for-information-technology-securitycommon-criteria-for-information-technology-security-evaluation-version-2.1-1-december-1999)

# PUBLIC LAW

## 1.1 P.L. 73-416, Communications Act of 1934, 19 June 1934

The purpose of the Communications Act of 1934 was to regulate interstate
and foreign communications by wire and radio in the public interest. It
established the Federal

Communications Commission and addressed radio stations operated by
foreign governments, willful or malicious interference with radio
transmissions, and assigned war powers to the President. The Secretary
of Commerce will serve as the President's principal adviser on
telecommunications policies pertaining to the Nations economic and
technological advancement. The Secretary of Commerce will also advise
the Director of the Office of Management and Budget relating to the
procurement and management of Federal telecommunications systems. The
Secretary will also develop policies, which relate to international
telecommunications issues in coordination with the Secretary of State
and other interested agencies. Amendments to the act since 1934 were
generally narrow in focus and scope until the Telecommunications Act of
1996.

## 1.2 P.L. 93-579, Privacy Act of 1974, 31 December 1974

The objective of the Privacy Act of 1974 is to protect personal privacy
from invasions by

Federal agencies, in light of increasing use of information technology
in the Federal government and the associated increase in personal
information maintained by Federal agencies. The law allows individuals
to specify what information may be held by a government agency and gives
individuals the right to obtain information held on them by the Federal
government. It also levies civil and criminal penalties for violations
of the provisions of the Act. As a Federal agency, Treasury's
responsibilities under the Act include:

-   Implementation of physical security practices, information
    management practices, and computer and network controls necessary to
    ensure individual privacy.

## 1.3 P.L. 95-511, Foreign Intelligence Surveillance Act of 1978, 25 October 1978

*The Foreign Intelligence Surveillance Act of 1978* \[50 USCS §§ 1801 ET
SEQ.\] (FISA) is used to obtain electronic surveillance and physical
searches without warrant, but under court order, in cases of foreign
intelligence, international terrorism, or sabotage activities that are
perpetrated by a foreign power or its agent. It is an alternative to
Title III warrants, which are used in most cases that concern the
potential criminal prosecution of US Persons. The major legal difference
in the two statutes is that to obtain a court order under FISA, the
applicant does not have to prove the level of probable cause that is
required for Title III electronic surveillance or for search warrants.
The reason for this is that the primary purpose of a FISA order is to
collect foreign intelligence information and not to prosecute US
Persons. The Act has been upheld in numerous challenges, including cases
of courts martial of on-duty servicemen who were charged under the
Uniform Code of Military Justice.

The FISA is used by the DOD, and in fact, *The Executive Order Number
12139 of May 23, 1979, 44 Fed. Reg. 3031*1, provides that the Secretary
of Defense and the Deputy Secretary of Defense may be appointed by the
President, with the advice and consent of the Senate, to make
certifications to the Attorney General, as required by the Act, that the
application being submitted to the Foreign Intelligence Surveillance
Court conforms to the requirements of the Act. This certification power
applies to applications for electronic surveillance as well as physical
searches.

## 1.4 P.L. 99-474, Computer Fraud and Abuse Act of 1986.

The act provides for unlimited fines and imprisonment of up to 20 years
if a person "intentionally accesses a computer without authorization or
exceeds authorized access and, by means of such conduct, obtains
information that has been determined ..to require protection against
unauthorized disclosure..." It is also an offense if a person
intentionally accesses "a Federal interest computer without
authorization and, by means of one or more instances of such conduct
alters, damages, or destroys information...or prevents authorized use of
such computer..or traffics any password or similar information...if such
computer is used by or for the Government of the United States."

## 1.5 P.L. 99-508, Electronic Communications Privacy Act of 1986, 21 October 1986

P.L. 99-508 updated Federal privacy clause in Omnibus Crime Control and
Safe Streets Act of 1968 to include digitized voice, data, or video
whether transmitted over wire, microwave, or fiber optics. The act
applies to transmissions regardless whether they are carried by common
or other carriers. Included transmissions where users had an expectation
of privacy. Cellular phones were included but cordless were not. The
Communications Assistance for Law Enforcement Act of 1994 (Digital
Telephone Act) added cordless phones and specified certain data
communications transmitted over radio. Warrants are now required for
interception of cordless phone conversations. Court warrants, based on
probable cause, are required to intercept wire or oral communications.
Exceptions to the warrant requirement are: telephone companies and the
FCC, police officers when they are a party to the call, and with the
consent of one party.

## 1.6 P.L. 100-235, Computer Security Act of 1987, 8 January 1988

The Computer Security Act declares that improving the security and
privacy of sensitive information in Federal computer systems is in the
public interest, and creates a means for establishing minimum acceptable
security practices for such systems. It assigns NIST responsibility for
developing standards and guidelines needed to assure the cost-effective
security and privacy of sensitive information in Federal computer
systems. NIST will draw on the technical advice and assistance
(including work products) of the National Security Agency, where
appropriate. \[In 1989, NIST and NSA executed an MOU to clarify roles
and responsibilities under the Act\].

The Act specifically excludes from NIST purview, Federal classified and
Warner Exempt systems. NIST is authorized to assist the private sector,
upon request, in using and applying the results of its programs and
activities. The Act also established the National Computer System
Security and Privacy Advisory Board (CSSPAB). CSSPAB is a twelve member
advisory group of recognized experts in computer and telecommunications
systems security and technology. The CSSPAB advises the Secretary of
Commerce and Director, NIST. The CSSPAB's mission is to identify issues
relative to computer systems security and privacy. The Board scope is
limited to Federal unclassified systems. Key responsibilities include:

-   In coordination with NIST, each government agency must establish a
    computer security policy commensurate with the risk and magnitude of
    the harm resulting from the loss, misuse, or unauthorized access to
    or modification of the information contained in the system.

```{=html}
<!-- -->
```
-   Each government agency will develop security plans by all operators
    of Federal computer systems that contain sensitive information.

```{=html}
<!-- -->
```
-   Summaries of agency security plans shall be included in the
    information resources management plan required by the Paperwork
    Reduction Act of 1980.

```{=html}
<!-- -->
```
-   Each government agency will provide mandatory periodic training for
    all persons involved in management, use, or operation of Federal
    computer systems that contain sensitive information.

## 1.7 P.L. 103-62, Government Performance and Results Act of 1993, 3 August 1993

The purpose of the Government Performance and Results Act (GPRA) is to
reform Federal program performance with a series of pilot projects in
setting program goals, measuring program performance against these
goals, and public reporting on their progress. The Act requires agencies
to submit strategic plans for program activities to OMB and Congress by
September 30, 1997, and to establish performance goals for program
activities, which are objective, quantifiable, and measurable.

## 1.8 P.L. 104-13, Paperwork Reduction Acts of 1980, 1995, 22 May 1995

The Paperwork Reduction Act of 1980, as amended by the Paperwork
Reduction Act of 1995, is the principal information resources management
(IRM) statute for the Federal government. It created the Office of
Information and Regulatory Affairs (OIRA) in OMB to establish
government-wide IRM policies and oversee and review agency
implementation. The act specifically requires agencies to acquire/use IT
to improve service delivery and program management, increase
productivity, enhance the quality of decision-making, and reduce fraud
and waste. It also requires that agencies develop 5-year plans for
meeting the agency's IT needs and that the agency head designate a
senior IRM official (who reports directly to the agency head) to carry
out agency IRM responsibilities under the act. The act also assigned OMB
responsibility for improving Federal government administrative
efficiency through the use of new technologies such as electronic mail
and electronic document storage (imaging). The Act makes OMB responsible
for developing governmentwide guidance on information security and
overseeing agency practices. The Paperwork Reduction Act of 1995, in 44
U.S.C. 3505 and 3506, requires agencies to establish computer security
programs and it tasks OMB to develop and oversee the implementation of
policies, principles, standards and guidelines on security. It also
requires Federal Agencies to identify and provide security protection
consistent with the Computer Security Act of 1987 (40 U.S.C. 759 note)
and directs OMB to require Federal agencies to apply a risk management
process for information collected or maintained by or on behalf of an
agency.

Responsibilities under the Paperwork Reduction Act include:

-   Complying with policies issued by the Director, OMB.

```{=html}
<!-- -->
```
-   Designating a senior official, reporting directly to the Secretary
    of the Treasury to carry out the responsibilities of the Act.

```{=html}
<!-- -->
```
-   With respect to general information resources management, each
    agency shall manage information resources to improve the integrity,
    quality, and utility of information to all users within and outside
    the agency, including capabilities for ensuring protections for
    privacy and security.

-   With respect to privacy and security, each agency shall:

```{=html}
<!-- -->
```
-   implement and enforce applicable policies, procedures, standards,
    and guidelines on privacy, confidentiality, security, disclosures
    and sharing of information collected or maintained by or for the
    agency;

```{=html}
<!-- -->
```
-   assume responsibility and accountability for compliance with and
    coordinated management of sections 552 and 552a of title 5, the
    Computer Security Act of 1987, and related information management
    laws; and

```{=html}
<!-- -->
```
-   consistent with the Computer Security Act of 1987, identify and
    afford security protections commensurate with the risk and magnitude
    of the harm resulting from the loss, misuse, or unauthorized access
    to or modification of information collects or maintained by or on
    behalf of an agency.

## 1.9 P.L. 104-104, Telecommunications Act of 1996/Communications Decency Act of 1996, 8 February 1996

This Act is known by two different names as indicated above, depending
upon the emphasis applied by the reader to different aspects of the law.
The main part of the Act is to provide for a pro-competitive,
de-regulatory national policy framework. It was designed to accelerate
private sector deployment of advanced telecommunications and information
technologies and services to all Americans by opening all
telecommunications markets to competition. Noteworthy were the
provisions of Title V on obscenity and violence which have incited much
litigation since the law's enactment (hence its other enactment short
title).

The Telecommunications Act of 1996 will in time revolutionize the
telecommunications industry by greatly expanding the numbers and types
of telecommunications carriers and combinations of services. It is the
most significant overhaul of national telecommunications policy since
the Communications Act of 1934. This Act is seen as a completion of the
Bell System divestiture and de-regulation of the 1970s in that it allows
long-distance telephone companies to re-enter the local service market
and the local companies, such as GTE, to enter the long distance market.
Today software and advanced switching equipment make it possible for
numerous competitive local telephone companies to interconnect and
provide seamless communication. Changes to public law contained in the
Act require all incumbent local telephone monopolies to interconnect
with new competitors' networks.

The intention is that consumers will have more choices because competing
companies will develop better technology and offer better service to
their customers to keep them. And the customers served by this Act
include users in the government. Switching to a Competitive Local
Exchange Carrier (CLEC) should be easy. The switchover will require
neither a change in any phone numbers nor new equipment. The user will
be able to elect to: access local fiber optic networks as well as select
local, long distance and enhanced services from any number of providers.
The act also provides for a wide range of services and media, including
radio and television, broadcast, cable services, and most
telecommunications services.

It addresses: unfair billing practices; privacy; facilities siting;
mobile services access to long distance carriers; encouragement of
advanced telecommunications capabilities; encouragement and support to
the National Educational Telecommunications Funding Corporation. Finally
it provides for a report to Congress by the Departments of Commerce, and
Health and Human Services regarding studies and demonstrations on
telemedicine funded by the Public Health Service or other Federal
agencies. The report examines questions related to patient safety; the
efficacy and quality of the services provided as well as other legal,
medical, and economic issues related to the use of advanced
telecommunications services for medical purposes.

## 1.10 P.L. 104-106, Information Technology Management Reform Act of 1996, National Defense Authorization Act for Fiscal Year 1996 (Clinger-Cohen Act), 10 February 1996

The Information Management Reform Act of 1996 (ITMRA) is a subordinate
act (Division E) of the National Defense Authorization Act for Fiscal
Year 1996. The ITMRA was later renamed the Clinger-Cohen Act. The ITMRA
repeals the Brooks Automatic Data Processing Act relieving the GSA of
responsibility for procurement of automated systems and contract
appeals. OMB is charged with providing guidance, policy, and control for
information technology procurement. The ITMRA also requires agencies to
appoint Chief Information Officers and to use business process
reengineering and performance measures to ensure effective IT
procurement and implementation. Changes to Federal Acquisition
Regulations, Circular A-130, and a new executive order are expected to
help implement the requirements of the Act. Together with the Paperwork
Reduction Act, as amended, the Acts explicitly outline OMB's
responsibilities for overseeing agency practices regarding information
privacy and security. The ITMRA also reemphasizes OMB, NIST and agency
responsibilities regarding information security.

## 1.11 P.L. 104-201, National Defense Authorization Act for Fiscal Year 1997, 23 September, 1996

The National Defense Authorization Act for Fiscal Year 1997 (Subtitle
F\--Other Matters, Section 1061, Policy on Protection of National
Information Infrastructure Against Strategic Attack) directs the
President to submit a report to Congress which sets forth national
policy on protecting the national information infrastructure against
strategic attack. In addition to providing an update of a similar report
requested in the 1996 Defense Authorization Act (Kyl Amendment),
Congress asks the President to include the following in the policy:

-   Plans to meet essential government and civilian needs during a
    national security emergency associated with a strategic attack
    against the NII.

```{=html}
<!-- -->
```
-   The identification of information infrastructure functions that must
    be performed during such an emergency.

```{=html}
<!-- -->
```
-   The assignment of responsibilities to federal departments and
    agencies and a description of the roles of government and industry
    relating to indications and warning, assessment, response to, and
    reconstitution after such an attack.

```{=html}
<!-- -->
```
-   Matters that are in need of further study and resolution such as
    technology and funding shortfalls.

```{=html}
<!-- -->
```
-   Legal and regulatory considerations relating to the national policy.

The National Defense Authorization Act for Fiscal Year 1997 (Section
1062, Information Systems Security Program) also directs the Secretary
of Defense to allocate to the information systems security program
(program element 0303140K) an amount equal to the percentages indicated
below of the funds appropriated for the Defense Information
Infrastructure (DII). The allocated funds are to be in addition to funds
allocated to NSA and DARPA. Additionally, the Secretary is to submit a
report to Congress, no later than November 15, 1997, the on the
information security activities of the DOD:

-   For FY 99, 2.5%

```{=html}
<!-- -->
```
-   For FY 00, 3.0%

```{=html}
<!-- -->
```
-   For FY 01, 3.5%

-   For FY 02, 4.0%.

## 1.12 5 USC 552, Freedom of Information Act (FOIA) of 1974, as amended by P.L. 104-231, Electronic Freedom of Information Act of 1996, 2 October 1996

FOIA requires agencies to make available, on its own initiative, certain
types of records and disclose any other record to a requestor unless a
specific exemption under FOIA, of which there are nine, applies.

Electronic Freedom of Information Act Amendments of 1996 amends the
Freedom of Information Act (FOIA) to define \"record\" to mean
information maintained by an agency, as a required agency record, in any
format, including an electronic format. EFOIA requires an agency to make
available for public inspection and copying: (1) copies of all records,
regardless of form or format, which have been released to an individual
and which, because of the nature of their subject matter, have become or
are likely to become the subject of subsequent requests for
substantially the same records; (2) a general index of such records,
which shall be made available electronically by December 31, 1999; and
(3) within one year after November 1, 1996, by computer
telecommunications or other electronic means, those records created on
or after November 1, 1996.

Records, which reveal vulnerabilities to information systems, such as
risk analyses, contingency plans, system security plans, and incident
reports, are exempt from FOIA under exemption 2B.

## 1.13 P.L. 104 - 294, Title I, Economic Espionage Act of 1996, 11 October 1996

The Economic Espionage Act resolves many gaps and inadequacies in
existing federal laws by specifically proscribing the various acts
defined under economic espionage, and addressing the national security
aspects of the crime. It also provides forfeiture of proceeds obtained
as a result of economic espionage, preserves the confidentiality in any
prosecution, and provides for extraterritorial jurisdiction. It makes
the theft of trade secrets a federal crime and provides stiff penalties
and prison sentences for specific acts of economic espionage. It also
eliminates gaps in criminal laws covering attacks against computers and
the information they contain.

## 1.14 P.L. 104-294, Title II, National Infrastructure Protection Act of 1996, 11 October, 1996

The NII Protection Act resulted from an Executive Branch initiative to
address protecting the confidentiality, integrity, and availability of
data and systems and revise the Computer Fraud and Abuse Act (18 U.S.C.
1030). Key changes to 18 USC 1030 include:

-   Section 1030 (a) (1), the espionage clause, explains the criminality
    of the unauthorized use (insider or outsider) of a computer to
    obtain information that *could be used* to injure the U.S. Previous
    wording required proof that the information *is to be used to*
    injure the U.S. One of the reasons for this lessened burden of proof
    is that violation of this clause carries with it only a maximum of
    10-year imprisonment.

-   Section 1030 (a) (2) is designed to protect the confidentiality of
    computer data. This is confidentiality as it relates to privacy. The
    DOD view of confidentiality relating to national security
    information is actually captured in Section 1030 (a) (1) which, as
    noted above, addresses computers used in espionage.

```{=html}
<!-- -->
```
-   The 1994 amendment inadvertently may have decriminalized some
    activity when it replaced the former term "federal interest
    computer" with the term " computer used in interstate commerce or
    communications." The 1996 amendment introduces the term "protected
    computer" which includes government computers, financial institution
    computers, and any computer used in interstate or foreign commerce
    or communications.

```{=html}
<!-- -->
```
-   Section 1030 (a) (5). Both the 1994 and the 1996 amendments ensured
    that insider abuse, in excess of authority, was included. All
    insider abuse had been previously excluded from the provisions of
    this statue. Under the existing code, intentional damage is a
    felony, be it an insider or outsider. For an outsider, reckless
    damage is also a felony, while negligent damage is a misdemeanor.
    Reckless or negligent damage caused by insiders is not a federal
    crime. The rationale for this is there are a range of administrative
    sanctions (from firing to \...) available for insiders who
    recklessly or negligently cause damage. Federal sanctions are
    reserved for those insiders who intentionally cause damage.

```{=html}
<!-- -->
```
-   Under the 1994 amendment, "Damage" was considered to include
    financial losses in excess of \$5,000 and impact on medical
    treatment. The 1996 Act adds causing physical damage to any person
    and threatening public health and safety.

-   \"Threats to the normal operation of a computer\" was added as
    Subsection 1030 (a) (7).

```{=html}
<!-- -->
```
-   The amendment explicitly maintains the status quo of the FBI and the
    Secret Service shared jurisdiction.

## 1.15 44 USC 3504, Government Paperwork Elimination Act

Government Paperwork Elimination Act requires the Director of the Office
of Management and Budget: (1) in providing direction and overseeing the
acquisition and use of information technology, to include alternative
information technologies that provide for electronic submission,
maintenance, or disclosure of information as a substitute for paper and
for the use and acceptance of electronic signatures; (2) to develop
procedures for the use and acceptance of electronic signatures by
executive agencies; (3) to ensure that, within five years, executive
agencies provide for the option of electronic maintenance, submission,
or disclosure of information as a substitute for paper and for the use
and acceptance of electronic signatures, when practicable; (4) to
develop procedures to permit private employers to store and file
electronically with executive agencies forms containing information
pertaining to employees; and (5) in cooperation with the National
Telecommunications and Information Administration, to conduct and report
the Congress on an ongoing study of the use of electronic signatures on
paperwork reduction and electronic commerce, individual privacy, and the
security and authenticity of transactions.

## 1.16 P.L. 105-220, Section 508 Accessibility, 7 August 1998

This law makes significant changes to current law in the areas of
accessibility and electronic and information technology standards. These
changes include requiring Federal agencies to procure, maintain, and use
electronic and information technology that provides individuals with
disabilities with comparable access to what is available to individuals
without disabilities.

## 1.17 P.L. 106-398, National Defense Authorization Act, Fiscal Year 2001 Title X Subtitle G, Government Information Security Reform Act, 30 October 2000

The Security Act amends the Paperwork Reduction Act of 1995 (PRA) (44
U.S.C. Chapter 35), by enacting a new subchapter on \"Information
Security\" which primarily addresses the program management and
evaluation aspects of security. This Act applies to all agencies covered
by the PRA. It covers programs for both unclassified and national
security systems and within the agencies creates the same management
framework for each. At the policy level, the two programs remain
separate. The Security Act requires annual agency program reviews,
annual Inspector General security evaluations, agency reporting to OMB,
and an annual OMB report to Congress. This law sunsets in two years.

# EXECUTIVE ORDERS

## 2.1 Executive Office of the President, Executive Order 12333, United States Intelligence Activities, The White House, Washington DC, 4 December 1981

Intelligence effort to provide necessary information on which to base
decisions to the President and to protect national interests from
foreign security threats. Special emphasis to countering espionage
directed against U.S. government, corporations, establishments or
persons. Secretary of Defense named executive agent for signals
intelligence and communications security activities. NSA to execute the
responsibilities of the SECDEF as executive agent for communications
security. NSA to conduct research and development as necessary for
signals intelligence and communications security. Department of Energy
will support NSA as requested. Restricts collection techniques to
procedures established by the agency head and approved by the Attorney
General (See Foreign Intelligence Surveillance Act of 1978). DOD
responsibilities include:

-   Secretary of Defense:

```{=html}
<!-- -->
```
-   Executive Agent for signals intelligence and communications security
    of the Federal Government

```{=html}
<!-- -->
```
-   Collect military foreign intelligence and counterintelligence

```{=html}
<!-- -->
```
-   Provide for the timely transmission of critical intelligence within
    the U.S. government

```{=html}
<!-- -->
```
-   Protect the security of Department of Defense installations,
    activities, property, information and employees by appropriate
    means.

```{=html}
<!-- -->
```
-   National Security Agency:

```{=html}
<!-- -->
```
-   Establish and operate an effective organization for signals
    intelligence

```{=html}
<!-- -->
```
-   Execute Executive Agent responsibilities for communication security
    of the Federal government

```{=html}
<!-- -->
```
-   Conduct research and development in signals intelligence and
    communications security

```{=html}
<!-- -->
```
-   Conduct foreign cryptologic relationships.

```{=html}
<!-- -->
```
-   Foreign Intelligence Elements of the Armed Forces:

```{=html}
<!-- -->
```
-   "Collection of national foreign intelligence, not otherwise
    obtainable, outside the United States shall be coordinated with the
    CIA, and such collection within the United States shall be
    coordinated with the FBI."

```{=html}
<!-- -->
```
-   Agencies of the Intelligence Community:

```{=html}
<!-- -->
```
-   May provide specialized equipment, technical knowledge, or
    assistance of expert personnel to support law enforcement
    activities.

## 2.2 Executive Office of the President, Executive Order 12472, Assignment of National Security and Emergency Preparedness Telecommunications Functions, The White House, Washington D.C., 3 April 1984

Established the National Communications System, an interagency group
made up of 23 Federal departments and agencies. The NCS is responsible
for ensuring that NS/EP telecommunications are available across a
spectrum of national emergencies. NCS was to serve as a forum for
government agencies and private sector. To facilitate this process, E.O.
12472 established the Committee of Principals for the Federal government
to coordinate with the National Security Telecommunications Advisory
Committee consisting of industry representatives. DOD responsibilities
include:

-   Secretary of Defense:

```{=html}
<!-- -->
```
-   Serve as the Executive Agent of the NCS

-   Designate a Manager of the NCS

-   Plan, operate and maintain telecommunications services for the
    National Command Authorities (NCA)

```{=html}
<!-- -->
```
-   Ensure NSA plans for security and protection of NS/EP
    telecommunications.

```{=html}
<!-- -->
```
-   National Communications System (NCS):

```{=html}
<!-- -->
```
-   Assist the President, National Security Council, Office of Science
    and Technology Policy, and Office of Management and Budget plan for
    NS/EP communications for the Federal government

```{=html}
<!-- -->
```
-   Serve as focal point for joint industry-government planning and
    operations

```{=html}
<!-- -->
```
-   Establish a joint industry-government National Coordinating Center.

```{=html}
<!-- -->
```
-   NCS Committee of Principals:

```{=html}
<!-- -->
```
-   Serve as a forum for the review and evaluation of ongoing and
    prospective NS/EP telecommunications programs

-   Serve as a forum for each agency to report on their ongoing or
    prospective telecommunications programs in support of NS/EP.

```{=html}
<!-- -->
```
-   Manager of the NCS:

```{=html}
<!-- -->
```
-   Recommend to the Executive Agent and COP an evolutionary
    architecture, plans to remove or minimize technical impediments to
    interoperability of government owned or leased telecommunications
    systems and test and exercise programs

```{=html}
<!-- -->
```
-   Chair the NCS Committee of Principals and provide staff support

```{=html}
<!-- -->
```
-   Implement approved plans or programs

```{=html}
<!-- -->
```
-   Serve as the joint industry-government focal point including
    technical information concerning the NS/EP telecommunications
    requirements of the Federal government.

## 2.3 Executive Office of the President, Executive Order 12958, Classified National Security Information, The White House, Washington D.C., 17 April 1995

*Executive Order 12958* outlines a uniform system for classifying,
safeguarding, and declassifying national security information, to
include who may classify or declassify and under what circumstances. The
purpose of the Order is to prevent unauthorized disclosure of national
security information and to prevent over-classification. The order
recognizes "that it is essential that the public be informed concerning
the activities of its Government, but" certain national defense and
foreign relations information must be protected. It specifies the
classification levels, authorities, delegation authorities and rules for
declassification and downgrading of this information. The baseline
period for review for declassification is set at 10 years with specific
categories of allowed exceptions.

"Information" is defined as any information or material, regardless of
its physical form or characteristics. The document also directs that
each head of agency establish uniform procedures to ensure the integrity
of classified information processed by information systems and to
prevent unauthorized access to such systems and data. Assigned
responsibilities and functions include:

-   National Security Council:

```{=html}
<!-- -->
```
-   Provide overall policy direction for the information security
    program.

```{=html}
<!-- -->
```
-   Administrator of General Services:

```{=html}
<!-- -->
```
-   Responsible for implementing and monitoring the program

```{=html}
<!-- -->
```
-   Delegate these functions to the Information Security Oversight
    Office.

```{=html}
<!-- -->
```
-   Information Security Oversight Office:

```{=html}
<!-- -->
```
-   Develop directives for the implementation of this order

```{=html}
<!-- -->
```
-   Oversee compliance and implementation

-   Conduct on-site reviews.

```{=html}
<!-- -->
```
-   Federal Agencies:

```{=html}
<!-- -->
```
-   Promulgate implementing regulations

```{=html}
<!-- -->
```
-   Appoint a senior agency official to administer its information
    security program.

## 2.4 Executive Office of the President, Executive Order 13010, Critical Infrastructure Protection, The White House, Washington D.C., 15 July 1996

The purpose of Executive Order 13010 is to develop a strategy for
protecting and assuring the continued operation of the following
critical infrastructures: telecommunications, electrical power systems,
gas and oil storage and transportation, banking and finance,
transportation, water supply systems, emergency services (including
medical, police, fire and rescue) and continuity of government. Because
the infrastructures are privately owned and operated, the government and
the private sector must work together to develop a strategy. The order
establishes:

The *President's Commission on Critical Infrastructure Protection*
consists of representatives from the Executive Branch, State and Local
Government, and the Private Sector. The Chair of the Commission will be
appointed by the President from outside the government. Not more than
two full-time representatives will be appointed by the heads of the
following departments and agencies:

-   The Department of the Treasury

```{=html}
<!-- -->
```
-   The Department of Energy

```{=html}
<!-- -->
```
-   The Department of Justice

```{=html}
<!-- -->
```
-   Central Intelligence Agency

```{=html}
<!-- -->
```
-   The Department of Defense

```{=html}
<!-- -->
```
-   Federal Emergency Management Agency

```{=html}
<!-- -->
```
-   The Department of Commerce

```{=html}
<!-- -->
```
-   The Federal Bureau of Investigation

```{=html}
<!-- -->
```
-   The Department of Transportation

```{=html}
<!-- -->
```
-   The National Security Agency

*The Principals Committee* consisting of:

-   The Secretary of the Treasury

```{=html}
<!-- -->
```
-   The Secretary of Defense

```{=html}
<!-- -->
```
-   The Director of the Office of Management and Budget

```{=html}
<!-- -->
```
-   The Attorney General

```{=html}
<!-- -->
```
-   The Secretary of Commerce

```{=html}
<!-- -->
```
-   The Director of the Federal Emergency Management Agency

```{=html}
<!-- -->
```
-   The Secretary of Transportation

```{=html}
<!-- -->
```
-   The Secretary of Energy

```{=html}
<!-- -->
```
-   The Assistant to the President for National Security Affairs

```{=html}
<!-- -->
```
-   The Director of Central Intelligence

```{=html}
<!-- -->
```
-   The Assistant to the Vice President for National Security Affairs

*The Steering Committee* consisting of four members appointed by the
President. One member shall be the Chair of the Commission and one will
be an employee of the Executive Office of the President

*The Advisory Committee to the President's Commission on Critical
Infrastructures* composed of not more than ten individuals from the
private sector appointed by the President.

*The Infrastructure Protection Task Force (IPTF)* within the Department
of Justice, chaired by the Federal Bureau of Investigation, consisting
of at least one full-time representative from the FBI, the DOD, the NSA,
and part-time assistance from other Executive Branch departments and
agencies.

Assigned responsibilities and functions include:

-   The Steering Committee:

```{=html}
<!-- -->
```
-   Shall oversee the work of the Commission on behalf of the Principals
    Committee

```{=html}
<!-- -->
```
-   Shall approve the submission of reports to the Principals Committee

```{=html}
<!-- -->
```
-   Shall oversee the work of the IPTF.

```{=html}
<!-- -->
```
-   The Principals Committee:

```{=html}
<!-- -->
```
-   The Commission reports to the President through the Principals
    Committee

```{=html}
<!-- -->
```
-   Review Commission reports and recommendations before submission to
    the President.

```{=html}
<!-- -->
```
-   The Commission:

```{=html}
<!-- -->
```
-   Shall identify and consult with public and private sectors,
    including Congress that own or operate critical infrastructures,
    contribute to infrastructure assurance, or that may have differing
    perspectives

```{=html}
<!-- -->
```
-   Shall assess the scope and nature of the vulnerabilities of, and
    threats to, critical infrastructures

```{=html}
<!-- -->
```
-   Determine and assess legal and policy issues associated with efforts
    to protect critical infrastructures

-   Recommend a comprehensive national policy and implementation
    strategy for protecting critical infrastructures from physical and
    cyber threats

```{=html}
<!-- -->
```
-   Propose statutory and regulatory changes.

```{=html}
<!-- -->
```
-   The Infrastructure Protection Task Force (IPTF):

```{=html}
<!-- -->
```
-   Increase coordination of existing infrastructure protection efforts
    while the Commission is conducting its analysis and until the
    President acts on the Commissions recommendations.

```{=html}
<!-- -->
```
-   Identify and coordinate existing expertise, inside and outside of
    the Federal Government, to:

```{=html}
<!-- -->
```
-   Provide, or facilitate and coordinate the provision of, expert
    guidance to critical infrastructures to detect, prevent, halt, or
    confine an attack and to recover and restore service

-   Issue threat and warning notices

```{=html}
<!-- -->
```
-   Provide training and education on methods to reduce vulnerabilities
    and responding to attacks

-   Conduct after action analyses

```{=html}
<!-- -->
```
-   Coordinate with pertinent law enforcement authorities.

```{=html}
<!-- -->
```
-   The Department of Defense:

```{=html}
<!-- -->
```
-   Shall provide the Commission and the Advisory Committee with
    administrative services, staff, others support services, and funds
    and may, at the Commissions request, contract for the services of
    non-governmental consultants.

```{=html}
<!-- -->
```
-   All Executive Departments and Agencies:

```{=html}
<!-- -->
```
-   Shall cooperate with the Commission and the IPTF, provide
    assistance, information, and advice, and share information about
    threats and warning of attacks and information about actual attacks
    to the extent permitted by law

```{=html}
<!-- -->
```
-   Shall, at the Commissions request, request that existing Federal
    advisory committees consider and provide advice on issues of
    critical infrastructure protection.

## 2.5 Executive Office of the President, Executive Order 13011, Federal Information Technology, The White House, Washington D.C., 16 July 1996

The E.O. requires agencies to significantly improve IT acquisition and
management by faithfully implementing the relevant provisions of the
Paperwork Reduction Act of 1995 and the Information Technology
Management Reform Act of 1996. Agencies are to refocus IT planning to
more directly support their strategic mission, implement a budget-linked
capital planning and investment process and rethink the way they do
their work before investing in information technology to support the
work (business process reengineering).

Agencies are also to establish clear accountability for IT management by
creating agency Chief Information Officers (CIO). The E.O. establishes
three groups:

-   The CIO Council to improve agency practices on such matters as the
    design, modernization, use sharing, and performance of agency
    information resources.

```{=html}
<!-- -->
```
-   The Government Information Technology Services Board to ensure
    continued implementation of the IT recommendations of the National
    Performance Review.

```{=html}
<!-- -->
```
-   The Information Technology Resources Board to provide independent
    assessments of specific IT systems proposed or under development and
    make recommendations to the agency and OMB.

Under the E.O., Treasury is required to:

-   Establish mission-based performance measurers for IT investments,
    aligned with agency performance plans prepared pursuant to the
    Government Performance and Results Act

```{=html}
<!-- -->
```
-   Establish agency-wide and project-level management structures and
    processes that will be responsible and accountable for managing and
    evaluating investments in IT with authority to terminate troubles IT
    systems

```{=html}
<!-- -->
```
-   Support appropriate training

```{=html}
<!-- -->
```
-   Support the interagency structure established by the order

```{=html}
<!-- -->
```
-   Select CIO's

```{=html}
<!-- -->
```
-   Structure major information systems into projects as narrow in scope
    and brief in duration as practical to reduce promote flexibility and
    interoperability, and better match mission requirements with current
    technology.

## 2.6 E.O., Computer Software Piracy, 1 October 1998

This executive order established the policy of the United States
Government that each executive agency shall work diligently to prevent
and combat computer software piracy in order to give effect to
copyrights associated with computer software by observing the relevant
provisions of international agreements in effect in the United States,
including applicable provisions of the World Trade Organization
Agreement on Trade-Related Aspects of Intellectual Property Rights, the
Berne Convention for the Protection of Literary and Artistic Works, and
relevant provisions of Federal law, including the Copyright Act.

## 2.7 E.O. 13228, Establishing the Office of Homeland Security and the Homeland Security Council, 8 October 2001

This order established the Office of Homeland Security. The mission of
the office shall be to develop and coordinate the implementation of a
comprehensive national strategy to secure the United States from
terrorist threats or attacks. The Office will perform the functions
necessary to carry out this mission, including national strategy and
detection functions.

The Homeland Security Council is responsible for advising and assisting
the President with all aspects of homeland security. The Secretary of
the Treasury is a member of this council.

## 2.8 E.O. 13231, Critical Infrastructure Protection in the Information Age, 16 October 2001

This executive order is established to protect against disruption of the
operation of information systems for critical infrastructure and thereby
help to protect the people, economy, essential human and government
services, and national security of the United States, and to ensure that
any disruptions that occur are infrequent, of minimal duration, and
manageable, and cause the least damage possible. It established the
President's Critical Infrastructure Protection Board, which is charged
with recommending policies and coordinating programs for protecting
information systems for critical infrastructure, including emergency
preparedness communications, and the physical assets that support such
systems. The Secretary of the Treasury is a member of this board.

It also defines several standing committees. The National Security
Telecommunication and Information Systems Security Committee, that was
established under National Security Directive 42, is established as a
standing committee and renamed the Committee on National Security
Systems.

# OTHER NATIONAL POLICY

## 3.1 Presidential/National Security Directives

### 3.1.1 PD/NSC 24, Telecommunications Protection Policy (U), 16 November 1977 (Partially declassified/released on 18 February 1994)

*\[Superseded and canceled by NSDD 145; which, in turn, was superseded
by NSD 42. Excepted from cancellation are mandated ongoing
telecommunications protection activities\]*

UNCLASSIFIED ABSTRACT: PD 24 established the NSC Special Coordinating
Committee, which evolved to become the NSTISSC. The SECDEF is appointed
the Executive Agent for classified and unclassified national security
information. The Secretary of Commerce is appointed the Executive Agent
government-derived unclassified information (except national security
information) and for dealing with the commercial and private sector to
enhance communications protection and privacy. It establishes national
telecommunications policy requiring:

-   Classified information be transmitted only by secure means

```{=html}
<!-- -->
```
-   Unclassified information that would be useful to an adversary should
    be protected during transmission

```{=html}
<!-- -->
```
-   Non-governmental information that would be useful to an adversary
    shall be identified and the private sector informed and encouraged
    to take appropriate measures

```{=html}
<!-- -->
```
-   Responsible agencies work with the FCC and common carriers to adopt
    system capabilities which protect the privacy of individual
    communications

```{=html}
<!-- -->
```
-   Private sector telecommunications carriers should be briefed (DoC
    lead) on the nature of the threat and appropriate government R&D
    information shall be made available.

DOD responsibilities include:

-   The SECDEF shall act as the executive agent for communications
    security (COMSEC) to protect government-derived classified
    information and government-derived unclassified information, which
    relates to national security. Through the industrial security
    program, initiate new and improved personal and telecommunications
    security measures among Defense contractors.

```{=html}
<!-- -->
```
-   Revitalizing security training for US government personnel who use
    telephones and other means of communications for both unclassified
    and classified purposes.

-   Executing all measures required to assure the security of DOD
    telecommunications and the control of compromising emanations.

### 3.1.2 NSD 42, National Policy for the Security of National Security Telecommunications and Information Systems, 5 July 1990

Issued, in part, to bring executive policy in-line with the Computer
Security Act of 1987, this directive establishes initial objectives,
policies, and an organizational structure to guide the conduct of
activities to secure national security systems from exploitation. It
establishes a mechanism for policy development and dissemination; and
assigns responsibilities for its implementation. NSD 42 establishes the
NSC Policy Coordinating Committee for National Security
Telecommunications and Information Systems (NSTISSC). Except for ongoing
telecommunications protection activities mandated by and pursuant to PDD
24 and NSDD-145, NSDD-145 is rescinded. \[PD-24 was rescinded by NSDD
145\]

Responsibilities:

-   The NSTISSC shall develop specific operating policies, procedures,
    guidelines, instructions, standards, and priorities as may be
    required to implement the directive; provide systems security
    guidance for national security systems to Executive departments and
    agencies; submit annually to the Executive Agent and evaluation of
    the security status of national security systems; approve the
    release of cryptologic national security systems technical security
    material, information and techniques to foreign governments.

```{=html}
<!-- -->
```
-   The Executive Agent (SECDEF) shall: ensure the development of plans
    and programs to fulfill the objectives of the directive; procure and
    provide technical security material, assistance and services
    necessary to the accomplish the objectives of the directive; approve
    and provide minimum security standards and doctrine for systems
    subject to this directive; conduct research, etc.; operate or
    coordinate the efforts of U.S. government technical centers related
    to national security telecommunications and information systems
    security.

```{=html}
<!-- -->
```
-   The National Manager (DIRNSA) shall examine:

```{=html}
<!-- -->
```
-   U.S. government national security systems and evaluate their
    vulnerability to foreign interception and exploitation;

```{=html}
<!-- -->
```
-   Act as the U.S. government focal point for cryptography,
    telecommunications systems security, and information systems
    security for national security systems;

-   Review and approve standards, etc.;

```{=html}
<!-- -->
```
-   Conduct foreign computer security and communications security
    liaison, including entering into agreements with foreign governments
    and with international and private organizations regarding national
    security systems (exception - intelligence);

```{=html}
<!-- -->
```
-   Assess the overall security posture of and disseminate information
    on threats to and vulnerabilities of national security systems;
    operate a central technical center to evaluate and certify the
    security of national security telecommunications and information
    systems;

```{=html}
<!-- -->
```
-   Prescribe minimum standards, methods and procedures for protection;

-   Review and assess annually the programs and budgets of executive
    departments and agencies for national-security telecommunications
    systems security; coordinate with NIST in accordance with Computer
    Security Act of 1987

```{=html}
<!-- -->
```
-   The Heads of Executive Departments and Agencies shall be responsible
    for achieving and maintaining secure national security systems
    within their departments or agencies; ensure policies, procedures,
    guidelines, etc. are implemented; provide appropriate information to
    the NSTISSC.

```{=html}
<!-- -->
```
-   The Director, OMB shall specify data to be provided during the
    annual budget review by executive departments and agencies on
    program budgets relating to security of their national security
    systems; consolidate and provide such data to the National Manager
    via the Executive Agent; review for consistency with this directive,
    and amend as appropriate, OMB policies and regulations which may
    pertain to the subject matter.

### 3.1.3 PDD/NSC 29, Security Policy Coordination, 16 September 1994

PDD 29 revised the security policy process based upon the greater
diversity of threats to

U.S. national security following the end of the Cold War. It recognizes
a broader range of issues that affect national security, including
economic issues and the proliferation of technologies from those used to
create weapons of mass destruction to information technology. PDD 29
created the Security Policy Board. This Board addresses a variety of
security issues, including information systems security and risk
management. The Security Policy Board considers, coordinates, and
recommends for implementation to the President, through the Assistant to
the President for National Security Affairs, policy directives for U.S.
security policies, procedures, and practices. The Security Policy Board
is the principal mechanism for reviewing and proposing to the NSC
legislative initiatives and executive orders pertaining to U.S. security
policy, procedures, and practices that do not fall under the statutory
jurisdiction of the Secretary of State. This Board coordinates the
development of interagency agreements and resolves conflicts that may
arise over the terms and implementation of these agreements. In
coordinating security policy, procedures and practices, the Policy Board
ensures that all U.S. Departments and Agencies affected by such
decisions are allowed to comment on such proposals.

PDD 29 also established a Security Policy Advisory Board to serve as an
independent, non-governmental advisory body. The President will appoint
five members, including a Chairman, for terms of up to 3 years. The
Chairman will report annually to the President through the Assistant to
the President for National Security Affairs. The Security Policy
Advisory Board will also provide a non-governmental and public interest
perspective on security policy initiatives to the Security Policy Board
and the intelligence community. The Office of Management and Budget is
represented on the Security Policy Board and Forum and the Overseas
Security Policy Board. The Information Security Oversight Office has a
representative on the Security Policy Forum.

### 3.1.4 PDD 39, Secret, U.S. Policy on Counterterrorism, 1996

UNCLASSIFIED ABSTRACT: PDD 39 directs measures to combat terrorism.
These include reducing vulnerabilities to terrorism, deterring and
responding to terrorist acts, and having capabilities to prevent and
manage the consequences of terrorist use of nuclear, biological and
chemical (NBC) weapons, including those of mass destruction. Specific
efforts include reviewing the vulnerability of government facilities and
critical national infrastructure. The Director, FEMA will ensure that
the Federal Response Plan is adequate for consequence management
activities in response to terrorist attacks against large U.S.
populations.

\[Source: NSC approved unclassified FEMA abstract. Requested and
publicly released by Senator Nunn\]

### 3.1.5 PDD 62, Combating Terrorism, 22 May 1998

PDD-62 addresses the national problem of countering terrorism in all its
varied forms. It highlights the growing range of unconventional threats
faced by the Nation, including newer forms of more familiar chemical,
radiological, and biological weapons as well as the emergence of
\"cyber-terrorism.\" The directive creates a new and more systematic
approach to defending against them. The first step is to create within
the Executive Office of the President a new National Coordinator (for
Security, Infrastructure Protection and Counter-Terrorism). This
official is responsible for coordinating the government and private
partnership, which will assure the national and economic security as
well as the well being of its citizenry.

The new National Coordinator for Security, Infrastructure Protection and
Counter-Terrorism reports to the President through the National Security
Advisor and when the NSC Principals Committee meets on security issues,
serves as a full member of that Cabinet-level committee. This new
"Security Czar" will coordinate with other presidential advisors in
their area of expertise to address key infrastructure support issues,
especially: the Director of the Office of Scientific Technology and
Policy; and cabinet secretaries in their roles as lead agencies for
various sectors.

### 3.1.6 PDD 63, Protecting America\'s Critical Infrastructures, 22 May 1998

PDD-63 focuses specifically on protecting the Nation\'s critical
infrastructures from both physical and \"cyber\" attack. These attacks
may come from foreign governments, foreign and domestic terrorist
organizations, and foreign and domestic criminal organizations.

The National Coordinator oversees the efforts of the government in
formulating the Federal

Critical Infrastructure Protection (CIP) Plan and coordinating the
National Plan for CIP with the private sector. The new national security
structure for CIP brings together the efforts of the National
Infrastructure Assurance Council, the Critical Infrastructure
Coordination Group, the National Security Telecommunication Advisory
Committee, the Manager of the National Communications System, and lead
cabinet agencies for special functions sand infrastructure industries.
The infrastructure sectors and their respective federal lead agencies
are:

####### Infrastructure Sector Lead Federal Agency

*Banking and Finance Department of Treasury*

*Transportation Department of Transportation*

*Electric and Gas & Oil Pipelines Department of Energy*

*Information/Communications Departments of Commerce and Defense*

*Government Services General Services Administration*

*Fire and Other Emergency Services Federal Emergency Management Agency*

*Public Health Services Department of Health and Human Services*

*Water Supplies Environmental Protection Agency*

The proponents of special functions are:

***Special Function Lead Federal Agency***

*Law Enforcement and Internal Security Department of Justice*

*National Defense Department of Defense*

*Intelligence The Central Intelligence Agency*

*Foreign Affairs Department of State*

The directive set up the Critical Infrastructure Assurance Office (CIAO)
under the Department of Commerce and the National Infrastructure
Protection Center (NIPC) under the sponsorship and guidance of the
Federal Bureau of Investigation (FBI). Finally, because the Government
has not received a Congressional mandate to regulate infrastructure
industries, the directive lays out the framework for a *voluntary*
Information Sharing and Analysis Center (ISAC), which will help to
coordinate information and efforts toward addressed CIP issues.

### 3.1.7 NSPD-1, Organization of the National Security System, 13 February 2001

This document is the first in a series of National Security Presidential
Directives (NSPD). NSPD shall replace both Presidential Decision
Directives and Presidential Review Directives as an instrument for
communicating presidential decisions about the national security of the
United States.

It establishes the make up of the National Security Council, and the
Deputy Committee and Principles Committee. It creates seventeen Policy
Coordinating Committees (PCC). It abolishes the Security Policy Board
(SPB), transferring the duties to whichever PCC should handle the
particular security problem being addressed.

## 3.2 Office of Management and Budget

### 3.2.1 Office of Management and Budget, OMB Circular A-76, \"Performance of Commercial Activities,\" Executive Office of the President, Publication Services, 4 August 1983

This Circular establishes Federal policy regarding the performance of
commercial activities. It is the policy of the United States Government
to:

-   Achieve Economy and Enhance Productivity. Competition enhances
    quality, economy, and productivity. Whenever commercial sector
    performance of a Government operated commercial activity is
    permissible, in accordance with this Circular and its Supplement,
    comparison of the cost of contracting and the cost of in-house
    performance shall be performed to determine who will do the work.

```{=html}
<!-- -->
```
-   Retain Governmental Functions in-house. Certain functions are
    inherently Governmental in nature, being so intimately related to
    the public interest as to mandate performance only by Federal
    employees. These functions are not in competition with the
    commercial sector. Therefore, Government employees shall perform
    these functions.

```{=html}
<!-- -->
```
-   Rely on the Commercial Sector. The Federal Government shall rely on
    commercially available sources to provide commercial products and
    services. In accordance with the provisions of this Circular, the
    Government shall not start or carry on any activity to provide a
    commercial product or service if the product or service can be
    procured more economically from a commercial source.

The critical definition for implementation of this Circular, especially
regarding IA, is that of Government performance of a commercial
activity. It is "one which is operated by a Federal executive agency and
which provides a product or service which could be obtained from a
commercial source. A commercial activity is not a governmental
function."

The following activities are defined as commercial activities, which
require a cost-benefit analysis and decision on outsourcing or other
appropriate action.

-   **Automatic Data Processing**

```{=html}
<!-- -->
```
-   ADP services - batch processing, time-sharing, facility management,
    etc.

-   Programming and systems analysis, design, development, and
    simulation

```{=html}
<!-- -->
```
-   Key punching, data entry, transmission, and teleprocessing services

```{=html}
<!-- -->
```
-   Systems engineering and installation

```{=html}
<!-- -->
```
-   Equipment installation, operation, and maintenance.

```{=html}
<!-- -->
```
-   **Security**

```{=html}
<!-- -->
```
-   Guard and protective services

```{=html}
<!-- -->
```
-   Systems engineering, installation, and maintenance of security
    systems and individual

```{=html}
<!-- -->
```
-   Privacy systems

```{=html}
<!-- -->
```
-   Forensic laboratories.

```{=html}
<!-- -->
```
-   **Special Studies and Analyses**

```{=html}
<!-- -->
```
-   Cost benefit analyses

```{=html}
<!-- -->
```
-   Statistical analyses

```{=html}
<!-- -->
```
-   Scientific data studies

```{=html}
<!-- -->
```
-   Regulatory studies

-   Defense, education, energy studies

-   Legal/litigation studies

-   Management studies.

```{=html}
<!-- -->
```
-   **Systems Engineering, Installation, Operation, Maintenance, and
    Testing**

```{=html}
<!-- -->
```
-   Communications systems - voice, message, data, radio, wire,
    microwave, and satellite

```{=html}
<!-- -->
```
-   Missile ranges

```{=html}
<!-- -->
```
-   Satellite tracking and data acquisition

```{=html}
<!-- -->
```
-   Radar detection and tracking

```{=html}
<!-- -->
```
-   Television systems - studio and transmission equipment, distribution
    systems, receivers, antennas, etc.

### 3.2.2 Office of Management and Budget, OMB Circular A-123, Management Accountability and Control, Executive Office of the President, Publication Services, 21 June 1995

OMB Circular A-123 implements the Federal Managers' Financial Integrity
Act (FMFIA). This Circular replaces Circular No. A-123 "Internal Control
Systems" revised, dated August 4, 1986 and OMB's 1982 "Internal Control
Guidelines". This revised Circular provides guidance to Federal managers
on improving accountability and effectiveness of Federal programs and
operations by establishing, assessing, correcting, and reporting on
management controls. This Circular provides policy for management
accountability and management controls and the attendant actions
required. Circular A-130 requires a review of security controls for each
system whenever significant changes are made to a system, but at least
every three years. If the review reveals that there is no assignment of
security responsibility, no security plan, or no authorization to
process for a system, consideration should be given to identifying a
deficiency pursuant to OMB Circular 123 and the FMFIA.

### 3.2.3 Office of Management and Budget, Supplement to OMB Circular A-76, \"Performance of Commercial Activities,\" Executive Office of the President, Publication Services, 8 February 1996

As noted in the Vice President\'s Third Report of the National
Performance Review, \"Common Sense Government: Works Better and Costs
Less,\" (September 1995), Americans want to \"get their money\'s worth\"
and want a Government that is more businesslike and better managed. The
reinvention of Government begins by focusing on core mission
competencies and service requirements. Thus, the reinvention process
must consider a wide range of options, including: consolidation,
restructuring or reengineering of activities, privatization options,
make or buy decisions, the adoption of better business management
practices, the development of joint ventures with the private sector,
asset sales, the possible devolution of activities to State and local
governments and the termination of obsolete services or programs. In the
context of this larger reinvention effort, the scope of this
Supplemental Handbook is limited to the conversion of recurring
commercial activities to or from in-house, contract or ISSA performance.
Circular A-76 is not designed to simply contract out. Rather, it is
designed to: (1) balance the interests of the parties to a make or buy
cost comparison, (2) provide a level playing field between public and
private offerors to a competition, and (3) encourage competition and
choice in the management and performance of commercial activities. It is
designed to empower Federal managers to make sound and justifiable
business decisions.

While the 1983 Circular establishes Federal policy for the performance
of recurring commercial activities, this Supplement to the Circular
replaces the Handbook issued with the 1983 Circular and provides updated
guidance and procedures for determining whether recurring commercial
activities should be operated under contract with commercial sources,
in-house using Government facilities and personnel, or through
interservice support agreements (ISSAs). The Revised Supplemental
Handbook is an integral part of the 1983 Circular.

The Supplement to the Circular sets forth procedures for determining
whether commercial activities should be performed under contract with
commercial sources or in-house using Government facilities and
personnel. A decision on the proper means of performing a commercial
activity may omit a cost-benefit analysis under any of the following
conditions:

National Defense

-   The Secretary of Defense shall establish criteria for determining
    when Government performance of a commercial activity is required for
    national defense reasons. Such criteria shall be furnished to the
    Office of Federal Procurement Policy, OMB, upon request.

```{=html}
<!-- -->
```
-   Only the Secretary of Defense or his designee has the authority to
    exempt commercial activities for national defense reasons.

### 3.2.4 M-99-18, Privacy Policies on Federal Web Sites, 2 June 1999

Every Federal web site must include a privacy policy statement, even if
the site does not collect any information that results in creating a
Privacy Act record. This statement tells the visitors to your site how
you handle any information you get from them. Federal agency web sites
are highly diverse, and have many different purposes. The privacy
policies that agencies write for those sites are also diverse. Agencies
must tailor their statements to the information practices of each
individual site. It is important to post your site's policy promptly, so
visitors to your site know the site's information practices.

### 3.2.5 Office of Management and Budget, OMB Circular A-127, Financial Management Systems, Executive Office of the President, Publication Services, 23 July 1993, Transmittal Memorandum #2, 10 June 1999.

This circular prescribes policies and procedures to be followed by
executive departments and agencies in developing, operating, evaluating,
and reporting on financial management systems. Transmittal Memorandum #2
relieves the requirement to purchase financial systems from the
Financial Management Systems Schedule (FMSS).

### 3.2.6 M-99-20, Security of Federal Automated Information Resources, 23 June 1999

The purpose of this memorandum is to remind agencies that, consistent
with the principles embodied in OMB Circular A-130, Appendix III,
\"Security of Federal Automated Information Resources,\" they must
continually assess the risk to their computer systems and maintain
adequate security commensurate with that risk.

### 3.2.7 M-00-07, Incorporating and Funding Security in Information Systems Investments, 28 February 2000

This memorandum reminds agencies of the Office of Management and
Budget\'s (OMB) principles for incorporating and funding security as
part of agency information technology systems and architectures and of
the decision criteria that will be used to evaluate security for
information systems investments. The principles and decision criteria
are designed to highlight our existing policy and thereby foster
improved compliance with existing security obligations; this memorandum
does not constitute new security policy. OMB plans to use the principles
as part of the FY 2002 budget process to determine whether an agency\'s
information systems investments include adequate security plans.

### 3.2.8 M-00-10, OMB Procedures and Guidance on Implementing the Government Paperwork Elimination Act, 25 April 2000

This document provides Executive agencies with the guidance required
under Sections 1703 and 1705 the Government Paperwork Elimination Act
(GPEA), P. L. 105-277, Title XVII. GPEA requires agencies, by October
21, 2003, to provide for the (1) option of electronic maintenance,
submission, or disclosure of information, when practicable as a
substitute for paper; and (2) use and acceptance of electronic
signatures, when practicable. GPEA specifically states that electronic
records and their related electronic signatures are not to be denied
legal effect, validity, or enforceability merely because they are in
electronic form.

### 3.2.9 M-00-13, Privacy Policies and Data Collection on Federal Web Sites, 22 June 2000

The purpose of this memorandum is to remind you that each agency is
required by law and policy to establish clear privacy policies for its
web activities and to comply with those policies. Agency contractors
should also comply with those policies when operating web sites on
behalf of agencies.

Agencies must take care to ensure full adherence with stated privacy
policies. For example, if an agency web site states that the information
provided would not be available to any other entities, it is the
responsibility of the agency to assure that no such sharing takes place.
To ensure such adherence, each agency should immediately review its
compliance with its stated web privacy policies.

Particular privacy concerns may be raised when uses of web technology
can track the activities of users over time and across different web
sites. These concerns are especially great where individuals who have
come to government web sites do not have clear and conspicuous notice of
any such tracking activities. Because of the unique laws and traditions
about government access to citizens\' personal information, the
presumption should be that \"cookies\" will not be used at Federal web
sites. Under this new Federal policy, \"cookies\" should not be used at
Federal web sites, or by contractors when operating web sites on behalf
of agencies, unless, in addition to clear and conspicuous notice, the
following conditions are met: a compelling need to gather the data on
the site; appropriate and publicly disclosed privacy safeguards for
handling of information derived from \"cookies\"; and personal approval
by the head of the agency. In addition, it is federal policy that all
Federal web sites and contractors when operating on behalf of agencies
shall comply with the standards set forth in the Children\'s Online
Privacy Protection Act of 1998 with respect to the collection of
personal information online at web sites directed to children.

### 3.2.10 Office of Management and Budget, OMB Circular A-130, Management of Federal Information Resources, Executive Office of the President, Publication Services, November 2000

This Circular establishes policy for the Management of Federal
Information Resources. Appendix III *(Security of Federal Automated
Information Resource*s) reflects a major revision of procedures found in
the previous circular in 1996. Appendix II contains the implementing
instruction for the Government Paperwork Elimination Act. Appendix III
incorporates requirements of the Computer Security Act of 1987 (P.L.
100-235) and responsibilities assigned in applicable national security
directives. It establishes a minimum set of management controls that are
to be included in federal automated information security programs. These
include assigning responsibility for security, developing a system
security plan, screening and training individual users, assessing risk,
planning for disasters and contingencies, and reviewing security
safeguards at least every three years. It recognizes that all federal
computer systems require some level of protection. It also requires
agencies to clearly define responsibilities and expected behavior for
all individuals with access to automated systems and to implement
security incident response and reporting capabilities. Specific
procedural and analytic guidance is provided for implementing Federal
automated information security programs, assignment of agency
responsibilities for security of automated information. Appendix III
also links agency automated information security programs and agency
management control systems established in accordance with OMB Circular
A-123.

As a Federal agency, Treasury responsibilities under A-130 include:

-   Agencies shall include a summary of their system security plans and
    major application plans in the strategic plan required by the
    paperwork Reduction Act (44 U.S.C. 3506)

```{=html}
<!-- -->
```
-   Agency programs shall include the following controls in general
    support systems and major applications

```{=html}
<!-- -->
```
-   General Support Systems:

> » Assign Responsibility for Security; Develop and Implement a System
> Security Plan as part of the organization's IRM planning process.

-   As part of the plan, establish a set of rules of behavior for
    individual users of each general support system. Rules should
    clearly delineate responsibilities of and expectations for all
    individuals with access to the he system. They should state the
    consequences of noncompliance.

> » Review the Security Controls (at least every three years or when
> significant modifications are made to the system)
>
> » Ensure that a Management Official Authorizes in Writing the Use of
> Each System (before beginning or significantly changing processing in
> the system).

-   Major Applications:

» Assign Responsibility for Security

» Develop and Implement a System Security Plan

» Perform an Independent Review or Audit of the Security Controls (at
least every three years)

» Ensure that a Management Official Authorizes in Writing the Use of the
Application.

### 3.2.11 M-01-08, Guidance on Implementing the Government Information Security Reform Act, 16 January 2001

The memorandum provides guidance to agencies on carrying out the Act.
The guidance focuses on unclassified Federal systems and addresses only
those areas of the legislation that introduce new or modified
requirements. The Act requires for both unclassified and national
security programs: 1) annual agency program reviews; 2) annual Inspector
General (IG) evaluations; 3) agency reporting to OMB the results of IG
evaluations for unclassified systems and audits of IG evaluations for
national security programs; and 4) an annual OMB report to Congress
summarizing the materials received from agencies. Agencies will submit
this information beginning in 2001 as part of the budget process.

The guidance also refers to some of the Act\'s provisions for national
security systems. Unless otherwise specified, implementation of those
provisions must be consistent with existing presidential directives
regarding national security systems.

### 3.2.12 M-01-24, Reporting Instructions for the Government Information Security Reform Act, 22 June 2001

On January 16, 2001, OMB issued memorandum 01-08, guidance to agencies
on implementing the Security Act. The guidance directs agency heads to
transmit to OMB in September, contemporaneous with their FY 2003 budget
materials, copies of the annual agency program reviews, independent
evaluations, and for national security systems, audits of the
independent evaluations. In addition to the program reviews and
evaluations, agency heads should also provide a brief executive summary,
not to exceed 15 pages, developed by the agency Chief Information
Officer, agency program officials, and the Inspector General that is
based on the results of their work. These executive summaries will serve
as the primary basis for OMB's summary report to Congress. Instructions
for completing the executive summary are detailed in the attachment.

### 3.2.13 Office of Management and Budget, OMB Circular A-11, Preparing and Submitting Budget Estimates, Executive Office of the President, Publication Services, 17 July 2001

OMB Circular No.A-11 tells you how to prepare your FY 2003 budget
submission. The Circular has three parts:

-   Part 1 covers your budget request and related materials.

```{=html}
<!-- -->
```
-   Part 2 covers your strategic plan, annual performance plan, and
    performance reports.

```{=html}
<!-- -->
```
-   Part 3 covers the acquisition of capital assets.

This circular is updated every year. The July 2001 transmittal contains
the instructions for the FY2003 budget.

From an IT Security perspective, the most important parts are those
where IT security is delineated. Part 1 Section 53 describes exhibit 53,
IT Investment Portfolio. The funding for IT security is provided in this
exhibit. Part 3 describes exhibit 300, Capital Asset Plan. The
description of the security plans for an IT asset is provided in this
exhibit. In Treasury, both exhibits are submitted using the I-TIPS
system.

### 3.2.14 M-02-01, Guidance for Preparing and Submitting Security Plans of Action and Milestones, 17 October 2001

OMB M-01-24 issued on June 22, 2001, directed agencies to submit to OMB
by October 31st (with brief quarterly updates thereafter) plans of
action and milestones (POA&M) to address all weaknesses identified by
program reviews and IG evaluations required by the Government
Information Security Reform Act of 2000, and previous OMB guidance. This
document provides guidance on preparing the POA&M, including sample
formats.

## 3.3 National Institute of Standards and Technology

The National Institute of Standards and Technology (NIST) is responsible
for providing standards and guidance to Federal Agencies for sensitive
systems.

### 3.3.1 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 73, Guidelines for Security of Computer Applications, 30 June 1980

This guideline describes the technical and managerial decisions that
should be made in order to assure that adequate controls are included in
new and existing computer applications to protect them from natural and
human-made hazards and to assure that critical functions are performed
correctly and with no harmful side effects.

### 3.3.2 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 87, Guidelines for Contingency Planning, 27 March 1981

FIPS 87 provides guidelines to be used in the preparation of contingency
plans.

### 3.3.3 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 81, DES Modes of Operation, 2 December 1980 with change notice 20 November 1981 

The Federal Data Encryption Standard (DES) (FIPS 46) specifies a
cryptographic algorithm to be used for the Cryptographic protection of
sensitive, but unclassified, computer data. FIPS 81 defines four modes
of operation for the DES that may be used in a wide variety of
applications. The modes specify how data will be encrypted
(cryptographically protected) and decrypted (returned to original form).
The modes included in this standard are the Electronic Codebook (ECB)
mode, the Cipher Block Chaining (CBC) mode, the Cipher Feedback (CF3)
mode, and the Output Feedback (OFB) mode.

### 3.3.4 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 102, Guideline for Computer Security Certification and Accreditation, 27 September 1983

This guideline describes how to establish and how to carry out a
certification and accreditation program for computer security. It
identifies and describes the steps involved in performing computer
security certification and accreditation; it identifies and describes
the important issues in managing a computer security certification and
accreditation program; and it identifies and describes the principal
functional roles needed within an organization to carry out such a
program. NIST is rewriting this guideline and will publish it as a
Special Publication.

### 3.3.5 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 112, Password Usage, 30 May 1985

FIPS 112 specifies basic security criteria for two different uses of
passwords in an ADP system, (1) personal identity authentication and (2)
data access authorization. It establishes the basic criteria for the
design, implementation, and use of a password system in those systems
where passwords are used.

### 3.3.6 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 180-1, Secure Hash Standard (SHS), 11 May 1993

FIPS 180-1 specifies the Secure Hash Algorithm (SHA-1). SHA-1 is
currently the *only* FIPS-approved method for secure hashing.

A revision to this standard is in coordination. The current approved
hash algorithm, SHA-1, produces a message digest of 160 bits, providing
no more than 80 bits of security against collision attacks. The proposed
Advanced Encryption Standard offers three key sizes: 128, 192 and 256
bits. There is a need for companion hash algorithms that provide similar
levels of enhanced security. New hash algorithms (SHA-256, SHA-384, and
SHA-512) have been developed and were described in the revised draft.
SHA-256 is a 256-bit hash function that is intended to provide 128 bits
of security against collision attacks, and SHA-512 is a 512-bit hash
function that is intended to provide 256 bits of security. A 384-bit
hash may be obtained by truncating the SHA-512 output.

### 3.3.7 National Institute of Standards and Technology, NIST Special Publication 800-12, An Introduction to Computer Security: The NIST Handbook, October 1995

Referenced frequently in Appendix III, OMB Circular A-130, this handbook
provides a broad overview of computer security to help readers
understand their computer security needs and develop a sound approach to
the selection of appropriate security controls. It assists in securing
computer-based resources (including hardware, software, and information)
by explaining important concepts, cost considerations, and
interrelationships of security controls. The handbook illustrates the
benefits of security controls, the major techniques or approaches for
each control, and important related considerations.

### 3.3.8 National Institute of Standards and Technology, NIST Special Publication 800-13, Telecommunications Security Guidelines for Telecommunications Management Network, October 1995

This guideline is intended to provide a security baseline for network
elements (NEs) and mediation devices (MDs) that is based on commercial
security needs. Some National Security/Emergency Preparedness (NS/EP)
security required will be integrated into the baseline to address
specific network security needs. This publication is the first of a
series of Telecommunications Security Guidelines (TSG) that may be
produced to address a hierarchy of telecommunications architectures of
increasing complexity.

### 3.3.9 National Institute of Standards and Technology, NIST Special Publication 800-14, Generally Accepted Principles and Practices for Security Information Technology Systems, September 1996

This document provides a baseline that can be used to establish and
review Information Technology (IT) security programs. Management,
internal auditors, users, system developers, and security practitioners
can use the guideline to gain an understanding of the basic security
requirements applicable to most IT systems. The security principles and
practices are to be applied in the use, protection, and design of
government information systems, particularly front-line systems for
delivering services in an electronic form.

### 3.3.10 National Institute of Standards and Technology, NIST Special Publication 800-16, Information Technology Security Training Requirements: A Role- and Performance-Based Model, April 1998

This document supersedes NIST Special Publication 500-172. It provides a
conceptual framework for providing IT security training. This framework
includes the IT security training requirements appropriate for a
distributed computing environment and provides flexibility for extension
to accommodate future technologies and the related risk management
decisions. The learning approach is designed to facilitate results-based
learning.

### 3.3.11 National Institute of Standards and Technology, NIST Special Publication 800-18, Guide for Developing Security Plans for Information Technology Systems, December 1998

This planning guide builds on SP 800-12 and SP 800-14. The sections of
this document easily map to SP 800-12. It is intended as a guide when
creating security plans for major applications and general support
systems. It can also be used as an auditing tool by auditors, managers,
and IT security officers.

### 3.3.12 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 46-3, Data Encryption Standard (DES), 25 October 1999 

FIPS 46-3 specifies the DES and Triple DES algorithms. These algorithms
may be used by federal agencies to protect sensitive information. For
the complete specification of Triple DES, the standard ANSI X9.52-1998,
Triple Data Encryption Algorithm Modes of Operation, must be used in
conjunction with FIPS 46-3. Copies of X9.52-1998 may be obtained from
X9, a standards committee for the financial services industry. Details
on the security of DES and migration from DES to Triple DES are
discussed in FIPS 46-3. NIST requires that all new encryption products
use Triple DES.

### 3.3.13 National Institute of Standards and Technology, NIST Special Publication 800-21, Guideline for Implementing Cryptography in the Federal Government, November 1999

This document provides guidance to Federal agencies on how to select
cryptographic controls for protecting sensitive unclassified
information. It focuses on Federal standards document in Federal
Information Processing Standards and the cryptographic modules and
algorithms that are validated against these standards.

### 

### 3.3.14 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 186-2, Digital Signature Standard (DSS), 15 February 2000

There are three FIPS-approved algorithms for generating and verifying
digital signatures: Digital Signature Algorithm (DSA), RSA (as specified
in ANSI X9.31), and Elliptic Curve DSA (ECDSA; as specified in ANSI
X9.62). New items in the DSS include: the approval of Elliptic Curve DSA
(ECDSA) as specified in ANSI X9.62, a list of recommended elliptic
curves for Federal Government use, and an allowance for the continues
acquisition of implementations of PKCS#1 for a transition period of
eighteen (18) months.

### 

### 3.3.15 National Institute of Standards and Technology, NIST Special Publication 800-23, Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products, August 2000

This document provides advice to agencies for sensitive (i.e.,
non-national security) unclassified systems. This advice complements
NSTISSP No. 11 issued for the national security community for the use
and acquisition of "information assurance" products.

### 3.3.16 National Institute of Standards and Technology (NIST), NIST Special Publication 800-25, Federal Agency Use of Public Key Technology for Digital Signatures and Authentication, October 2000

Federal agency officials should determine if the use of public key
technology for digital signatures and authentication makes good business
sense. Agency considerations of cost, risk, and benefit, as well as any
measures taken to minimize risks, should be commensurate with the level
of sensitivity of the transaction. This determination often needs to be
made on an application by application basis, with the understanding that
once a PKI is in place, it can serve multiple applications. This
document contains questions which Federal agency officials should answer
while evaluating a potential application. The questions cover five main
elements:

-   the benefits derived from implementing and using digital signatures
    for an application;

```{=html}
<!-- -->
```
-   the costs;

```{=html}
<!-- -->
```
-   the risks;

```{=html}
<!-- -->
```
-   how to compare the benefits, costs, and risks to arrive at a
    decision; and

```{=html}
<!-- -->
```
-   what issues to consider in implementing the decision.

### 3.3.17 National Institute of Standards and Technology (NIST), NIST Special Publication 800-32, Introduction to Public Key Technology and the Federal PKI Infrastructure, February 2001 

This publication was developed to assist agency decision-makers in
determining if a PKI is appropriate for their agency, and how PKI
services can be deployed most effectively within a Federal agency. It is
intended to provide an overview of PKI functions and their applications.

Additional documentation will be required to fully analyze the costs and
benefits of PKI systems for agency use, and to develop plans for their
implementation. This document provides a starting point and references
to more comprehensive publications.

### 3.3.18 National Institute of Standards and Technology (NIST), NIST Special Publication 800-24, PBX Vulnerability Analysis: Finding Holes in Your PBX Before Someone Else Does, April 2001

This report presents a generic methodology for conducting an analysis of
a Private Branch Exchange (PBX) in order to identify security
vulnerabilities. The report focuses on digital-based PBXs and addresses
the following areas for study: system architecture, hardware,
maintenance, administrative database/software, and user features.

### 3.3.19 National Institute of Standards and Technology (NIST), NIST Special Publication 800-27, Engineering Principles for Information Technology Security (A Baseline for Achieving Security), June 2001 

The purpose of the Engineering Principles for Information Technology
(IT) Security (EP-ITS) is to present a list of system-level security
principles to be considered in the design, development, and operation of
an information system.

Ideally, the principles presented here would be used from the onset of a
program---at the beginning of, or during the design phase---and then
employed throughout the system's life cycle.

However, these principles are also helpful in affirming and confirming
the security posture of already deployed information systems. The
principles are short and concise and can be used by organizations to
develop their system life-cycle policies.

### 3.3.20 National Institute of Standards and Technology, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, August 2001

This document builds on the *Federal IT Security Assessment Framework*
(Framework) developed by NIST for the Federal Chief Information Officer
(CIO) Council. The Framework established the groundwork for
standardizing on five levels of security status and criteria agencies
could use to determine if the five levels were adequately implemented.
This document provides guidance on applying the Framework by identifying
17 control areas, such as those pertaining to identification and
authentication and contingency planning. In addition, the guide provides
control objectives and techniques that can be measured for each area.

### 3.3.21 National Institute of Standards and Technology (NIST), NIST Special Publication 800-31, Intrusion Detection Systems (IDS), August 2001 

This guidance document is intended as a primer in intrusion detection,
developed for those who need to understand what security goals intrusion
detection mechanisms serve, how to select and configure intrusion
detection systems for their specific system and network environments,
how to manage the output of intrusion detection systems, and how to
integrate intrusion detection functions with the rest of the
organizational security infrastructure. References to other information
sources are also provided for the reader who requires specialized or
more detailed advice on specific intrusion detection issues.

### 3.3.22 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Modules, 25 May 2001 with change notice 1, 10 October 2001

Cryptographic modules are tested against requirements found in FIPS PUB
140-2, Security Requirements for Cryptographic Modules. Security
requirements cover eleven areas related to the design and implementation
of a cryptographic module Within most areas, a cryptographic module
receives a security level rating (1-4, from lowest to highest),
depending on what requirements are met. For other areas that do not
provide for different levels of security, a cryptographic module
receives a rating that reflects fulfillment of *all* of the requirements
for that area. An overall rating is issued for the cryptographic module,
which indicates (1) the minimum of the independent ratings received in
the areas with levels, and (2) fulfillment of all the requirements in
the other areas.

FIPS 140-2 is a mandatory federal standard.

### 3.3.23 National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) XXX, Advanced Encryption Standard (AES), Draft

The Advanced Encryption Standard (AES) will be a new Federal Information
Processing Standard (FIPS) Publication that will specify a cryptographic
algorithm for use by U.S. Government organizations to protect sensitive
(unclassified) information. NIST also anticipates that the AES will be
widely used on a voluntary basis by organizations, institutions, and
individuals outside of the U.S. Government - and outside of the United
States - in some cases. NIST has selected Rijndael as the proposed AES
algorithm. The algorithm\'s developers have suggested the following
pronunciation alternatives: \"Reign Dahl\", \"Rain Doll\", and \"Rhine
Dahl\". The draft FIPS has completed the comment period.

## 3.4 National Security Telecommunications and Information Systems Security Committee (NSTISSC)

The NSTISSC provides policies and instructions for information assurance
for national security applications (non-intelligence information). The
Department of the Treasury is a member of the NSTISSC. E. O. 13231
renamed the NSTISSC the Committee on National Security Systems.

### 3.4.1 NCSC-1, National Policy For Safeguarding and Control of Communications Security Material, 16 January 1981

Published by the National Communications Security Committee, this
National Policy encourages the use of COMSEC materials and techniques
and to safeguard and control COMSEC materials in a manner which assures
their continued integrity, prevents access by unauthorized persons and
controls the spread of COMSEC materials, techniques and technology when
not in the best interests of the US or its allies. Responsibilities
include:

-   Each department or agency holding COMSEC keying material must
    establish a COMSEC Material Control System into which all COMSEC
    keying material must be placed.

-   NSA will:

```{=html}
<!-- -->
```
-   Prescribe minimum security standards for performance of Central
    Office of Record functions by Federal Department and Agencies

```{=html}
<!-- -->
```
-   Establish procedures for reporting and evaluating communications
    security weaknesses

-   Establish doctrine and procedures to protect COMSEC information.

### 3.4.2 NCSC-5 w/ App 1 and 2, National Policy on Use of Cryptomaterial by Activities Operating in High Risk Environments, 16 January 1981

Published by the National Communications Security Committee, NCSC-5
establishes policy for the use of machine cryptosystems in high-risk
environments. It requires that NSA promulgated factors for machine
selection be considered, that workable plans be developed to protect,
evacuate, or destroy COMSEC equipments and materials, that only the
minimum amount of mission essential COMSEC material be located in the
high risk environment, and that point-to-point keying material will be
used. Appendix 1 is entitled *Guidelines for Identifying High Risk
Environments (U).*

### 3.4.3 NCSC-8, Confidential, National Policy on Securing Voice Communications (U), 7 May 1982

UNCLASSIFIED ABSTRACT: Not available.

### 3.4.4 NCSC-2, National Policy on Release of Communications Security Information to U.S. Contractors and Other U.S. Nongovernmental Sources, 7 July 1983

Published by the National Communications Security Committee, this
National Policy states that COMSEC operations will normally be conducted
by government personnel and limits the release of COMSEC material and
information to nongovernmental sources.

Nongovernment individuals granted access to classified COMSEC
information must be U.S. citizens and must hold a final Government
security clearance for the level of classification. All individuals
granted access to COMSEC information must be briefed at least annually
regarding the unique nature of COMSEC information and their security
responsibilities.

Agency responsibilities include:

-   Ensuring the requirements of the policy are met and determining that
    releases are in the best interests of the government

```{=html}
<!-- -->
```
-   Maintaining records of releases and notifying NSA

```{=html}
<!-- -->
```
-   Ensuring contractor performances meets established COMSEC standards
    and doctrine

```{=html}
<!-- -->
```
-   Incorporating policy criteria into all contracts. NSA will maintain
    a consolidated record of COMSEC contract and release notices,
    approve waivers from established physical security measures for the
    protection of COMSEC material, and provide assistance to other
    agency Heads.

### 3.4.5 NTISSP No 1, National Policy on Application of Communications Security to U.S. Civil and Commercial Space Systems, 17 June 1985

The *National Policy on Application of Communications Security to U.S.
Civil and Commercial*

*Space Systems* states that Government and Government contractor
national security information that is transmitted over satellite
circuits shall be protected from unauthorized intercept by approved
techniques.

*NTISSP No. 1* designates the National Security Agency as having
primary responsibility for coordinating with the heads of departments or
agencies to assess space systems telecommunication and command/control
uplink function vulnerabilities and providing approved protection
techniques and guidance.

### 3.4.6 NTISSP No 200, National Policy on Controlled Access Protection, 15 July 1987

*\[This policy preceded the Computer Security Act of 1987 which assigns
responsibility for sensitive unclassified information to DoC/NIST. A
draft replacement is in coordination\]*

Establishes a policy requiring that all automated information systems
accessed by multiple users with varying levels of authorization to
access classified or sensitive unclassified information provide
automated Controlled Access Protection within five years. Controlled
Access Protection is the C2 level of protection described in the Trusted
Computer System Evaluation Criteria. Major characteristics include:

-   Individual accountability through identification and authentication
    of each user

```{=html}
<!-- -->
```
-   Maintenance of audit trails of security-relevant events

```{=html}
<!-- -->
```
-   An ability to control a user's access to information according to
    the authorization the user has

-   Preventing one user from obtaining another user's data.

Exceptions are authorized where the software or hardware security
features are prohibitively costly, technically unsound, or may adversely
impact operational requirements. Heads of departments are cautioned to
continue to make progress toward reducing the circumstances that make
the exception necessary.

### 3.4.7 NSTISSP No 100, Confidential, National Policy on Application of Communications Security to Command Destruct Systems (U), 17 February 1988

UNCLASSIFIED ABSTRACT: Not available.

### 3.4.8 NSTISSD No. 501, National Training Program for Information Systems Security (INFOSEC) Professionals, 16 November 1992

NSTISSD 501 establishes the requirement for federal departments and
agencies to implement training programs for information systems security
(INFOSEC) professionals. For the purposes of the directive, an INFOSEC
professional is an individual who is responsible for the security
oversight or management of national security systems during each phase
of the life cycle.

### 3.4.9 NSTISSD No. 502, National Security Telecommunications and Automated Information Systems Security, 5 February 1993

NSTISSD 502 delineates and clarifies the objectives, policies,
procedures, standards, and terminology as set forth in NSD 42, *National
Policy for the Security of National Security*

*Telecommunications and Information Systems* (See NSD 42, 5 Jul 90).

### 3.4.10 NSTISSI No. 7000, Confidential NOFORN, TEMPEST Countermeasures for Facilities (U), 29 November 1993

UNCLASSIFIED ABSTRACT: Electronic and electromechanical information
processing equipment can produce unintentional intelligence-bearing
emanations, commonly known as TEMPEST. If intercepted and analyzed,
these emanations may disclose information transmitted, received,
handled, or otherwise processed by the equipment. NSTISSI 7000
establishes guidelines and procedures that shall be used by departments
and agencies to determine the applicable TEMPEST countermeasures for
national security systems.

### 3.4.11 NSTISSP No. 6, National Policy on Certification and Accreditation of National Security Telecommunications and Information Systems, 8 April 1994

Establishes a policy requiring all departments and agencies to establish
and implement programs that mandate the certification and accreditation
of national security systems under their control. The C&A programs shall
ensure that information processed, stored, or transmitted by national
security systems is adequately protected with respect to requirements
for confidentiality, integrity, and availability. National security
systems, are as defined in the national INFOSEC Glossary, and include
both classified systems and Title 10, section 2315 systems (Warner
Exempt). The policy also defines accreditation, certification, and
Designated Approving Authority.

### 3.4.12 NSTISSI No. 4011, National Training Standard for Information Systems Security (INFOSEC) Professionals, 20 June 1994

This instruction provides the minimum course content for the training of
information systems security (INFOSEC) professionals in the disciplines
of telecommunications security and automated information systems (AIS)
security. NSTISSD 501 establishes the requirement for federal
departments and agencies to implement training programs for INFOSEC
professionals. As defined in NSTISSD 501, an INFOSEC professional is an
individual who is responsible for the security oversight or management
of national security systems during phases of the life cycle. That
directive is being implemented in a synergistic environment among
departments and agencies, which are committed to satisfying these
INFOSEC education and training requirements in the most effective and
efficient manner possible.

### 3.4.13 NSTISSP No. 7, National Policy on Secure Electronic Messaging Services, 21 February 1995

Establishes a policy requiring Federal government departments and
agencies to establish and implement a program for secure government-wide
interoperable electronic messaging service for the protection of
information contained on national security systems. It defines
electronic messaging services as those, which, in addition to providing
interpersonal messaging capability, meet specified functional,
management and technical requirements, and, taken together, yield a
business-quality electronic mail service suitable for the conduct of
official government business.

### 3.4.14 NSTISSI No. 4012, National Training Standard for Designated Approving Authority (DAA), August 1997

This instruction is the second in a series of minimum training and
education standards, which are being developed to assist departments and
agencies in meeting their responsibilities in these areas. This
instruction provides the minimum course content for the training of
information systems Designated Approving Authority (DAA). This standard
uses the requirements for Job functions using competencies identified
in:

-   DoD 5200.28-M, Automated Data Processing Security Manual

```{=html}
<!-- -->
```
-   NCSC-TG-027, Version 1, A Guide To Understanding Information System
    Security Officer Responsibilities For Automated Information Systems

```{=html}
<!-- -->
```
-   NCSC-TG-029, Version 1, Introduction to Certification and
    Accreditation

```{=html}
<!-- -->
```
-   NCSC-TG-005, Trusted Network Interpretation

```{=html}
<!-- -->
```
-   FIPS Publication 102, Guideline for Computer Security Certification
    and Accreditation.

As specified in the NSTISSI the INFOSEC functions of a DAA are:

-   Granting final approval to operate an IS or network in a specified
    security mode.

```{=html}
<!-- -->
```
-   Reviewing the accreditation documentation to confirm that the
    residual risk is within acceptable limits.

```{=html}
<!-- -->
```
-   Verifying that each Information System complies with the IS security
    requirements, as reported by the Information Systems Security
    Officer (ISSO).

```{=html}
<!-- -->
```
-   Ensuring the establishment, administration, and coordination of
    security for systems that agency, service, or command personnel or
    contractors operate.

```{=html}
<!-- -->
```
-   Ensuring that the Program Manager (PM) defines the system security
    requirements for acquisitions.

```{=html}
<!-- -->
```
-   Assigning INFOSEC responsibilities to the individuals reporting
    directly to the DAA.

```{=html}
<!-- -->
```
-   Approving the classification level required for applications
    implemented in a network environment.

```{=html}
<!-- -->
```
-   Approving additional security services necessary to interconnect to
    external systems (e.g., encryption and non-repudiation).

```{=html}
<!-- -->
```
-   Reviewing the accreditation plan and signing the accreditation for
    the network and each IS.

```{=html}
<!-- -->
```
-   Defining the criticality and sensitivity levels of each IS.

```{=html}
<!-- -->
```
-   Reviewing the documentation to ensure each IS supports the security
    requirements as defined in the IS and network security programs.

```{=html}
<!-- -->
```
-   Allocating resources to achieve an acceptable level of security and
    to remedy security deficiencies.

```{=html}
<!-- -->
```
-   Establishing working groups, when necessary, to resolve issues
    regarding those systems requiring multiple or joint accreditation.
    This may require documentation of conditions or agreements in
    Memoranda of Agreement (MOA).

```{=html}
<!-- -->
```
-   Ensuring that, when classified or sensitive but unclassified
    information is exchanged between logically connected components, the
    content of this communication is protected from unauthorized
    observation by acceptable means, such as cryptography, and Protected
    Distribution Systems (PDS).

A DAA, who is given a final report requesting approval to operate a
hypothetical information system at a specified level of trust, should be
able to analyze and judge the information for validity and reliability
to ensure the hypothetical system will operate at the proposed level of
trust. This judgement will be made based on system architecture, system
security measures, system operations policy, system security management
plan, and provisions for system operator and end user training.

### 3.4.15 NSTISSI No. 4013, National Training Standard for System Administrators in Information Systems Security (INFOSEC), August 1997

This instruction is the third in a series of minimum training and
education standards, which are being developed to assist departments and
agencies in meeting their responsibilities in these areas. This
instruction provides the minimum course content for the training of
information systems administrators.

As specified in the NSTISSI the minimal INFOSEC performance standard for
the job functions of system administrators includes:

-   Working closely with the Information Systems Security Officer (ISSO)
    to ensure the Information System or network is used securely.

```{=html}
<!-- -->
```
-   Participating in the Information Systems Security incident reporting
    program.

```{=html}
<!-- -->
```
-   Assisting the ISSO in maintaining configuration control of the
    systems and applications software.

```{=html}
<!-- -->
```
-   Advising the ISSO of security anomalies or integrity loopholes.

```{=html}
<!-- -->
```
-   Administering, when applicable, user identification or
    authentication mechanism(s) of the IS or network.

A System Administrator, who is given various simulated scenarios and
typical situations containing information systems security issues,
should be able to describe and apply the appropriate actions to manage
and administer the IS(s) in a secure manner. To be acceptable, the
description must be in accordance with applicable INFOSEC regulations,
policies, and guidelines. The NSTISSI gives a full and detailed list of
performance items under competencies in each of the competency areas for
the job functions.

### 3.4.16 NSTISSI No. 4014, National Training Standard for Information Systems Security Officers (ISSO), August 1997

This instruction is the fourth in a series of minimum training and
education standards, which are being developed to assist departments and
agencies in meeting their responsibilities in these areas. This
instruction provides the minimum course content for the training of
information systems security officers. This standard uses the
requirements for Job functions using competencies identified in:

-   DoD 5200.28-M, Automated Data Processing Security Manual

```{=html}
<!-- -->
```
-   NCSC-TG-027, Version 1, A Guide To Understanding Information System
    Security Officer Responsibilities for Automated Information Systems

```{=html}
<!-- -->
```
-   DCID 1-16, Security Policy for Uniform Protection of Intelligence
    Processed in Automated Information Systems and Networks.

The INFOSEC functions of an ISSO are:

-   Maintaining a plan for site security improvements and progress
    towards meeting the accreditation.

```{=html}
<!-- -->
```
-   Ensuring the IS is operated, used, maintained, and disposed of in
    accordance with security policies and practices.

```{=html}
<!-- -->
```
-   Ensuring the IS is accredited and certified, if it processes
    sensitive information.

```{=html}
<!-- -->
```
-   Ensuring users and system support personnel have the required
    security clearances, authorization and need-to-know; are
    indoctrinated; and are familiar with internal security practices
    before access to the IS is granted.

```{=html}
<!-- -->
```
-   Enforcing security policies and safeguards on all personnel having
    access to the IS for which the ISSO is responsible.

```{=html}
<!-- -->
```
-   Ensuring audit trails are reviewed periodically (e.g., weekly,
    daily), and audit records are archived for future reference, if
    required.

```{=html}
<!-- -->
```
-   Initiating protective or corrective measures.

```{=html}
<!-- -->
```
-   Reporting security incidents in accordance with agency-specific
    policy, such as DOD 5200.1R, to the designated approving authority
    (DAA) when an IS is compromised.

```{=html}
<!-- -->
```
-   Reporting the security status of an IS, as required by the DAA.

```{=html}
<!-- -->
```
-   Evaluating known vulnerabilities to ascertain if additional
    safeguards are needed.

The Job performance objectives vary with the experience level of the
ISSO.

At the ENTRY LEVEL: Given a series of hypothetical system security
breaches, the ISSO should be able to identify system vulnerabilities and
recommend security solutions required to return the systems to
operational level of trust.

At the INTERMEDIATE LEVEL: Given a proposed new system architecture
requirement, the ISSO should be able to investigate and document system
security technology, policy and training requirements to assure system
operation at a specified level of trust.

At the ADVANCED LEVEL: Given a proposed IS accreditation action, the
ISSO should be able to analyze and evaluate the system security
technology, policy, and training requirements in support of DAA approval
to operate the system at a specified level of trust.

This analysis will include a description of the management/technology
team required to successfully complete the accreditation process.

The NSTISSI gives a full and detailed list of performance items under
competencies in each of the competency areas for the job functions.

### 3.2.17 NSTISSP No. 11, National Policy Governing the Acquisition of Information Assurance (IA) and IA-Enabled Information Technology (IT) Products, January 2000

It is important that Commercial Off the Shelf (COTS) products acquired
by U.S. Government Departments and Agencies be subject to a standardized
evaluation process which will provide some assurances that these
products perform as advertised. This policy was developed as a means of
addressing this problem for those products acquired for national
security applications. It also points out that protection of systems
encompasses more than just acquiring the right product. Once acquired,
these products must be integrated properly and subject to an
accreditation process that will ensure total integrity of the
information and systems to be protected.

By 1 July 2002, the acquisition of all COTS IA and IA-enabled IT
products to be used on national security systems shall be limited only
to those which have been evaluated and validated in accordance with the
following criteria, schemes, or programs below:

-   The International Common Criteria for Information Security
    Technology Evaluation Mutual Recognition Arrangement;

```{=html}
<!-- -->
```
-   The National Security Agency/National Institute of Standards and
    Technology National Information Assurance Partnership (NIAP)
    Evaluation and Validation Program; or,

```{=html}
<!-- -->
```
-   The NIST Federal Information Processing Standard (FIPS) validation
    program.

### 3.4.18 NSTISSI No. 1000, National Information Assurance Certification and Accreditation Process (NIACAP), April 2000

This instruction is the companion instruction to NSTISSP 6. It
establishes the minimum national standards for certifying and
accrediting national security systems. This process provides a standard
set of activities, general tasks, and a management structure to certify
and accredit systems that will maintain the Information Assurance (IA)
and security posture of a system or site. This process focuses on an
enterprise-wide view of the information system (IS) in relation to the
organization's mission and the IS business case.

### 3.4.19 NSTISSI No. 4009, National Information Systems Security Glossary, September 2000

This NSTISSI defines INFOSEC related terms and acronyms. It is a
complete revision of the glossary that the NSTISSC Glossary Working
Group last issued as NSTISSI 4009 in 1992, 1996, and 1997. To remain
useful, a glossary must be in a continuous state of coordination and
review to keep pace with changes in information systems security
terminology. It incorporates as new terms as they come into being and
old terms fall into disuse or change meaning. Some terms from the
previous version were deleted, others updated or added, and some are
identified as candidates for deletion.

### 3.4.20 NSTISSI 4015, National Training Standard for System Certifiers, December 2000

This instruction establishes the minimum course content or standard for
the development and implementation of education and training for system
certifier professionals in the disciplines of telecommunications
security and information systems security.

# FEDERAL CIO COUNCIL 

The Federal CIO Council provides guidance to Federal agencies on IT
issues.

## 4.1 Best Practices: Privacy*,* Internal Revenue Service Model Information Technology PRIVACY IMPACT ASSESSMENT, 25 February 2000

This Best Practice is being adopted as a guide for agencies to consider
while developing IT Privacy Impact Assessments (PIAs). Some of the
contents are agency specific and will need to be modified for
implementation in your agency. Specifically, Code Section 6103 and the
Policy Statement on Taxpayer Privacy Rights (in Appendix A) are unique
for IRS and taxpayer information. They are left in the document as
exemplars, that agencies may have laws, regulations and policies that
are unique to their agency - or industry of practice (such as health
care or banking and financial data) that apply and need to be
considered. Of course, OMB Circular A-130 should be reviewed when
developing IT privacy programs.

Public comment and/or external privacy advocate review is an important
feature that should be considered in a PIA process. In addition to the
process herein, agencies may want to consider at what intervals or what
events would require a PIA for an existing operational system. Whenever
a web front-end or public interface is added to a system is one obvious
threshold.

## 4.2 Memorandum to Chief Information Officers of all Agencies, Agency Interaction with GSA's Federal Computer Incident Response Capability (FedCIRC), 29 October 2000

With this memorandum, the Chief Information Officers\' (CIO) Council
provides practices for CIOs to follow in fulfilling their
responsibilities to protect agency information and systems and maintain
a computer incident response and information sharing capability,
consistent with OMB Circular A-130. We expect that agencies will
implement these practices. The CIO Council\'s Security, Privacy, and
Critical Infrastructure Committee developed the practices discussed in
this memorandum in cooperation with OMB, GSA and member agencies.

## 4.3 National Institute of Standards and Technology for the Security, Privacy and Critical Infrastructure Committee, Federal Information Technology Security Assessment Framework, 28 November 2000

The Federal Information Technology (IT) Security Assessment Framework
(or Framework) provides a method for agency officials to 1) determine
the current status of their security programs relative to existing
policy and 2) where necessary, establish a target for improvement. It
does not establish new security requirements. The Framework may be used
to assess the status of security controls for a given asset or
collection of assets. These assets include information, individual
systems (e.g., major applications, general support systems, mission
critical systems), or a logically related grouping of systems that
support operational programs, or the operational programs themselves
(e.g., Air Traffic Control, Medicare, Student Aid). Assessing all asset
security controls and all interconnected systems that the asset depends
on produces a picture of both the security condition of an agency
component and of the entire agency.

The Framework comprises five levels to guide agency assessment of their
security programs and assist in prioritizing efforts for improvement.
Coupled with the NIST-prepared self-assessment questionnaire (NIST SP
800-26), the Framework provides a vehicle for consistent and effective
measurement of the security status for a given asset. The security
status is measured by determining if specific security controls are
documented, implemented, tested and reviewed, and incorporated into a
cyclical review/improvement program, as well as whether unacceptable
risks are identified and mitigated.

# DEPARTMENT OF THE TREASURY

## Treasury Directives

### 5.1.1 TD P 85-03, Risk Assessment Guideline, June 1990

This guideline provides Treasury with a systematic approach to
performing cost-effective risk assessments. The structured approach
provides an appropriate mixture of quantitative and qualitative results.
The basic process remains valid; however, some of the threats,
vulnerabilities, and countermeasures are out-of-date.

### 5.1.2 Treasury Directive 71-10, Department of the Treasury Security Manual, 23 August 1999

This directive authorizes the Deputy Assistant Secretary for Information
Systems/CIO and the Director, Office of Security to jointly prescribe
and publish the Department of the Treasury Security Manual (Treasury
Department Publication \[TD P\] 71-10), which shall be issued as a
separate regulation and shall be binding on all Treasury bureaus. Any
reference to TD 71-10 shall be deemed to include this directive and the
Security Manual.

### 5.1.3 TD P 80-05, Records and Information Management Manual, September 1999

This manual covers the records and information management program
policies, objectives, responsibilities and includes guidance on:

-   The life cycle (creation and/or receipt; maintenance and use; and
    disposition) of specific categories of Federal records;

```{=html}
<!-- -->
```
-   Special issues of electronic records, including electronic mail
    (email) records;

-   Maintaining a forms management program;

```{=html}
<!-- -->
```
-   The process for obtaining approval of interagency reports;

```{=html}
<!-- -->
```
-   Records requirements for departing employees and political
    appointees; and

```{=html}
<!-- -->
```
-   Records and information management training.

### 5.1.4 Treasury Directive 80-05, Records and Information Management Program, 23 February 2000

This Directive provides policies and assigns responsibilities for
records management, forms management, and interagency reports
management. This Directive also authorizes the issuance of Treasury
Department Publication (TD P) 80-05, \"Records and Information
Management (RIM) Manual,\" which includes additional policy guidance for
specific categories of records.

### 5.1.5 Treasury Directive 81-01, Treasury Information Technology (IT) Programs, 13 April 2000

This Directive provides policies and assigns responsibilities for the
information resources management and information technology (IT)
programs. This directive also authorizes the CIO to prescribe and
publish the Treasury Department Publication (TD P) 81-01, Information
Technology (IT) Manual, which shall be issued as a separate document by
the CIO and shall be binding on all Treasury bureaus and offices.

### 5.1.6 Treasury Directive 74-14, Treasury Telework and Flexiplace Program, 18 October 2000

This directive establishes the Department's policy for alternative
workplace arrangements. It authorizes the use of Telework programs by
Treasury bureaus and offices by permitting employees to work full or
part-time at approved locations other than their official duty station.
This directive sets forth a program that provides an opportunity for an
employee to work at an alternative work site without changing an
employee's official duty station or other conditions of employment.

### 5.1.7 TD P 71-10, Department of the Treasury Security Manual, 16 January 1992 plus Transmittal notices through 9 April 2001

The Security Manual:

-   Provides uniform policies, standards and general procedures to be
    used by the bureaus to carry out their respective responsibilities
    in the areas of personnel, physical, telecommunications and
    information systems security, and emergency preparedness in
    accordance with the standards and guidelines issued by the
    Department, Department of Energy, office of Personnel Management
    (OPM), Federal Emergency Management Agency, National Security
    Agency, Department of Defense (DOD), Office of Management and
    Budget, General Services Administration, General Accounting Office,
    National Institute of Standards and Technology and the Security
    Policy Board; and,

```{=html}
<!-- -->
```
-   Implements and supplements, where necessary, Executive Orders,
    National Security directives, and other Government regulations by
    providing guidance when such regulations are not sufficiently
    detailed, or details are left to Departmental discretion.

### 5.1.8 Treasury Directive 87-05, Electronic Commerce Initiatives, 21 April 2001

This directive provides interim guidance for electronic commerce
(E-commerce) and electronic business (E-business) for the Department of
the Treasury (the Department) and recommends the processes by which
Treasury bureaus (bureaus) and Departmental Offices entities (DO) should
evaluate and manage any proposed E-commerce initiatives.

### 5.1.9 Treasury Directive 87-04, Personal Use of Government Office Equipment Including Information Technology, 17 May 2001 

This Directive defines acceptable personal use of government office
equipment including information technology by Department of the Treasury
employees. This policy applies to the employees of the Department except
that bureaus may modify it as it applies to their employees.

### 5.1.10 TD P 81-01, Information Technology Manual, 16 August 2001

The IT Manual:

-   Provides uniform policies and general procedures for use by the
    bureaus and offices in carrying out their IT responsibilities in
    several areas, including IT planning, IT architecture,
    telecommunications programs and services, information resources
    management, IT training, and IT standards, in accordance with the
    standards and guidelines issued by the Office of Management and
    Budget, General Services Administration, General Accounting Office,
    and the National Institute of Standards and Technology; and,

```{=html}
<!-- -->
```
-   Implements and supplements, where necessary, Executive Orders and
    other Government regulations by providing guidance when such
    regulations are not sufficiently detailed, or details are left to
    Departmental discretion.

## 5.2 Treasury Memoranda

### 5.2.1 Office of the CIO Memorandum Subject: Managing Internet Access, 28 April 1995

This memorandum transmitted the operating policy for managing Internet
access. Any access to the Internet services from Treasury AIS shall be
provided via protected internetwork gateways, which have been approved
by the Office of the CIO. Treasury AIS shall not be directly connected
to Internet services, either by dedicated or dial-up arrangements.

### 5.2.2 Office of the CIO Memorandum Subject: Internet Service Policy and Procedures for the Treasury Internet Gateway, 7 July 1995

This memorandum and its attachment details service policy and procedures
for Treasury bureaus and offices using the TCE Internet Gateway.

### 5.2.3 Office of the CIO Memorandum Subject: Interim Policy Guidance, 23 June 1999

This document provides interim policy guidance for the electronic
protection of sensitive information.

### 5.2.4 Office of the CIO Memorandum Subject: Guidance on Audit Log Retention Periods, 30 October 2000

This memorandum advised bureaus on existing National Archives and
Records Administration (NARA) guidance on audit log retention. It
advised bureaus to consult with their records managers and bureau chief
counsel on the appropriate retention period for the audit logs for each
system.

### 5.2.5 Office of the CIO Memorandum Subject: Guidance for Systems Security Plans, 30 October 2000

This memorandum advised bureaus to use either the NSTISSI 1000 or NIST
SP 800-18 for sensitive applications, NSTISSI 1000 for non-intelligence
classified systems, and the appropriate DCI directive for intelligence
systems.

### 5.2.6 Office of the CIO Memorandum Subject: Interim Policy on Product Assurance, 27 December 2000

This memorandum implements the policy in NSTISSP No 11 and NIST SP
800-23 for the assurance for products used to process Treasury
information.

### 5.2.7 Office of the CIO Memorandum Subject: Protection of Laptop Computers, 15 February 2001

This memorandum provides guidance on laptop security in a question and
answer format.

### 5.2.8 Office of the CIO Memorandum Subject: Interim Policy on Personal E-mail Accounts, 9 October 2001

This memorandum prohibits transmission of sensitive Treasury information
to any personal e-mail account and directs bureaus to employ a defense
in depth strategy, including automatically updated desktop anti-virus,
to provide protection from malicious software download from the Internet
or from personal e-mail.

## 5.3 Other Treasury Documents

### 5.3.1 Treasury Chief Information Officer Council, Treasury Enterprise Architecture Framework, July 2000

This document presents the Treasury Enterprise Architecture Framework to
provide:

-   A framework for producing an Enterprise Architecture (EA);

```{=html}
<!-- -->
```
-   Guidance for developing and using an EA; and

```{=html}
<!-- -->
```
-   Guidance for managing EA activities.

The framework includes documenting the security policy in the EA.

### 5.3.2 Internal Revenue Service Treasury Information Security Assessment Framework, May 2001

The Treasury CIO Council adopted the IRS Treasury Information Security
Assessment Framework (TISAF) as the standard methodology for assessing
security programs within the Department of the Treasury. It evaluates
seventeen (17) areas, using a red, yellow, green rating on the
effectiveness of each area.

### 5.3.3 Department of the Treasury, DASIS/Chief Information Officer, Office of Security, Security Classification Guide for the Department of the Treasury's Critical Information Assets Associated with Project Matrix, July 2001

This Security Classification Guide shall be used in making security
classification decisions pertinent to information gathered, compiled,
and reported for the risk analysis and risk management process, the
Treasury/bureau Computer Security Incident Response Capability (CSIRC)
response and reporting activity, the Department/bureau security program
management, and other related tasks associated with National Security
missions.

# Other

## Code of Federal Regulations (CFR)

The Code of Federal Regulations (CFR) is a codification of the general
and permanent rules published in the Federal Register by the Executive
departments and agencies of the Federal Government. The CFR is divided
into 50 titles, which represent broad areas subject to Federal
regulation. Each title is divided into chapters that usually bear the
name of the issuing agency. Each chapter is further subdivided into
parts covering specific regulatory areas. Large parts may be subdivided
into subparts. All parts are organized in sections, and most citations
to the CFR will be provided at the section level.

CFR Part 2635.11-12, "Standards of Ethical Conduct for Employees of the
Executive Branch" states "Personnel shall protect and conserve
Government property, including equipment, supplies and other property
entrusted to them." And "Personnel shall not use, or allow use of,
official information obtained through performance of duties to further a
private interest if such information is not available to the general
public."

## General Accounting Office

The U.S. General Accounting Office (GAO) is an agency that works for
Congress and the American people. Congress asks GAO to study the
programs and expenditures of the federal government. GAO, commonly
called the investigative arm of Congress or the congressional watchdog,
is independent and nonpartisan. GAO advises Congress and the heads of
executive agencies about ways to make government more effective and
responsive. GAO evaluates federal programs, audits federal expenditures,
and issues legal opinions.

### 6.2.1 General Accounting Office, GAO/AIMD-98-68, Executive Guide: Information Security Management Learning from Leading Organizations, May 1998

This guide is designed to promote senior executives\' awareness of
information security issues and to provide information they can use to
establish a management framework for more effective information security
programs. Most senior federal executives, like many of their private
sector counterparts, are just beginning to recognize the significance of
these risks and to fully appreciate the importance of protecting their
information resources. The opening segments describe the problem of weak
information security at federal agencies, identify existing federal
guidance, and describe the issue of information security management in
the context of other information technology management issues.

The remainder of the guide describes 16 practices, organized under five
management principles, that GAO identified during a study of nonfederal
organizations with reputations for having good information security
programs. Each of these practices contains specific examples of the
techniques used by these organizations to increase their security
program\'s effectiveness.

### 6.2.2 General Accounting Office, GAO/AIMD-00-33, Information Security Risk Assessment Practices of Leading Organizations, November 1999

This guide is intended to help federal managers implement an ongoing
information security risk assessment process by providing examples, or
case studies, of practical risk assessment procedures that have been
successfully adopted by four organizations known for their efforts to
implement good risk assessment practices. More importantly, it
identifies, based on the case studies, factors that are important to the
success of any risk assessment program, regardless of the specific
methodology employed.

### 6.2.3 General Accounting Office, GAO/AIMD-12.19.6, Federal Information System Controls Audit Manual: Volume 1 Financial Statement Audits, June 2001

This manual describes the computer-related controls that auditors should
consider when assessing the integrity, confidentiality, and availability
of computerized data. It is a guide applied by GAO primarily in support
of financial statement audits and is available for use by other
government auditors. It is not an audit standard. Its purposes are to

• Inform financial auditors about computer-related controls and related
audit issues so that they can better plan their work and integrate the
work of information systems (IS) auditors with other aspects of the
financial audit and

• Provide guidance to IS auditors on the scope of issues that generally
should be considered in any review of computer-related controls over the
integrity, confidentiality, and availability of computerized data
associated with federal agency systems.

The June 2001 version is primarily a reformatting of the January 1999
version. It also includes some additional references and some
hyperlinks.

## 6.3 International Standard ISO/IEC 15408, Evaluation Criteria for Information Technology Security/Common Criteria for Information Technology Security Evaluation version 2.1, 1 December 1999

The Common Criteria (CC) presents requirements for the IT security of a
product or system under the distinct categories of functional
requirements (CC Part 2) and assurance requirements (CC Part 3). The CC
functional requirements define desired security behavior. Assurance
requirements are the basis for gaining confidence that the claimed
security measures are effective and implemented correctly.

The CC defines a set of IT requirements of known validity, which can be
used in establishing security requirements for prospective products and
systems. The CC also defines the Protection Profile (PP) construct,
which allows prospective consumers, or developers to create standardized
sets of security requirements, which will meet their needs.

The Target of Evaluation (TOE) is that part of the product or system
which is subject to valuation. The TOE security threats, objectives,
requirements, and summary specification of security functions and
assurance measures together form the primary inputs to the Security
Target (ST), which is used by the evaluators as the basis for
evaluation.

The principal inputs to evaluation are the Security Target, the set of
evidence about the TOE and the TOE itself. The expected result of the
evaluation process is a confirmation that the ST is satisfied for the
TOE, with one or more reports documenting the evaluation findings.

Once a TOE is in operation vulnerabilities may surface or environmental
assumptions may require revision. Reports may then be made to the
developer requiring changes to the TOE. Following such changes
re-evaluation may be required.