I

PUBLICATIONS

U.S. DEPARTMENT OF COMMERCE

Technology Administration

National Institute of Standards and Technology

FIPS PUB 161-2

LtL*£

FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION

(Supersedes FIPS PUB 161-1—1993 April 19)

ELECTRONIC DATA INTERCHANGE (EDI)

Category: Software Standard Subcategory: Electronic Data Interchange

1996 APRIL 29
t
FIPS PUB 161-2

FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION

(Supersedes FIPS PUB 161-1—1993 April 19)

ELECTRONIC DATA INTERCHANGE (EDI)

Category: Software Standard Subcategory: Electronic Data Interchange

Computer Systems Laboratory

National Institute of Standards and Technology

Gaithersburg, MD 20899-0001

Issued April 29, 1996

U.S. Department of Commerce

Michael Kantor, Secretary

Technology Administration

Mary L. Good, Under Secretary tor Technology

National Institute of Standards

and Technology

Arati Prabhakar, Director
Foreword

»

The Federal Information Processing Standards Publications Series of the National

Institute of Standards and Technology (NIST) is the official publication relating to

standards and guidelines adopted and promulgated under the provisions of Section 5131

of the Information Technology Management Reform Act of 1996, and the Computer

Security Act of 1987, Public Law 104-106. These mandates have given the Secretary of

Commerce and NIST important responsibilities for improving the utilization and manage¬

ment of computer and related telecommunications systems in the Federal Government.

The NIST through its Computer Systems Laboratory provides leadership, technical

guidance, and coordination of Government efforts in the development of standards and

guidelines in these areas.

Comments concerning the Federal Information Processing Standards Publications

are welcomed and should be addressed to the Director, Computer Systems Laboratory,

National Institute of Standards and Technology, Gaithersburg, MD 20899.

Shukri A. Wakid, Director

Computer Systems Laboratory

Abstract f

This publication is a revision of the FIPS PUB 161-1. EDI is the computer-tocomputer interchange of strictly formatted messages that represent documents other

than monetary instruments. EDI implies a sequence of messages between two parties,

either of whom may serve as originator or recipient. The formatted data representing the

documents may be transmitted from originator to recipient via telecommunications or

physically transported on electronic storage media.

Key words: administration; commerce; computer; data; Federal Information Processing

Standard (FIPS); paperless interchange; trade.

National Institute of Standards

and Technology

U.S. Government Printing Office

Washington: 1996

For sale by the National

Technical Information

Service

U.S. Department of Commerce

Springfield, VA 22161

FIPS PUB 161-2

11 pages (Apr. 29, 1996)

CODEN: FIPPAT

I
FIPS PUB 161-2

Federal Information

Processing Standards Publication 161-2

1996 April 29

Announcing the Standard for

ELECTRONIC DATA INTERCHANGE (EDI)

Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National Institute of Standards and Technology

(NIST) after approval by the Secretary of Commerce pursuant to Section 5131 of the Information Technology Management Reform Act

of 1996 and the Computer Security Act of 1987, Public Law 104-106.

1. Name of Standard. Electronic Data Interchange (EDI) (FIPS PUB 161-2).

2. Category of Standard. Software Standard; Electronic Data Interchange.

3. Explanation.

3.1 Definition and Use of EDI. EDI is the computer-to-computer interchange of strictly formatted

messages that represent documents other than monetary instruments. EDI implies a sequence of messages

between two parties, either of whom may serve as originator or recipient. The formatted data representing

the documents may be transmitted from originator to recipient via telecommunications or physically trans¬

ported on electronic storage media.

In EDI, the usual processing of received messages is by computer only. Human intervention in the

processing of a received message is typically intended only for error conditions, for quality review, and for

special situations. For example, the transmission of binary or textual data is not EDI as defined here unless

the data are treated as one or more data elements of an EDI message and are not normally intended for

human interpretation as part of on-line data processing.

An example of EDI is a set of interchanges between a buyer and a seller. Messages from buyer to seller

could include, for example, request for quotation (RFQ), purchase order, receiving advice and payment

advice; messages from seller to buyer could include, similarly, bid in response to RFQ, purchase order

acknowledgment, shipping notice and invoice. These messages may simply provide information, e.g., receiv¬

ing advice or shipping notice, or they may include data that may be interpreted as a legally binding obligation,

e.g., bid in response to RFQ or purchase order.

EDI is being used also for an increasingly diverse set of concerns, for example, for interchanges between

healthcare providers and insurers, for travel and hotel bookings, for education administration, and for govern¬

ment regulatory, statistical and tax reporting.

3.2 Standards Required for EDI. From the point of view of the standards needed, EDI may be

defined as an interchange between computers of a sequence of standardized messages taken from a

predetermined set of message types. Each message is composed, according to a standardized syntax, of a

sequence of standardized data elements. It is the standardization of message formats using a standard

syntax, and the standardization of data elements within the messages, that makes possible the assembling,

disassembling, and processing of the messages by computer.

Implementation of EDI requires the use of a family of interrelated standards. Standards are required for,

at minimum: (a) the syntax used to compose the messages and separate the various parts of a message,

(b) types and definitions of application data elements, most of variable length, (c) the message types, defined

by the identification and sequence of data elements forming each message, and (d) the definitions and

sequence of control data elements in message headers and trailers.

1
FIPS PUB 161-2

Additional standards may define: (e) a set of short sequences of data elements called data segments,

(f) the manner in which more than one message may be included in a single transmission, and (g) the manner

of adding protective measures for integrity, confidentiality, and authentication into transmitted messages

3.3 Limited Coverage of this Standard. This FIPS covers only EDI. It does not cover other forms

of electronic interchange, for example, systems of interchange that do not consist of messages taken from

a predetermined set. Additionally, an interchange application including only one or two predetermined

message types using only fixed-length data elements is excluded from coverage of this FIPS. This FIPS also

is not intended to cover transmissions from medical, laboratory, or environment-sensing instrumentation.

3.4 The Long-Range Goal for EDI Standards. There are several different EDI standards in use

today, but the achievement of a single universally-used family of EDI standards is a long-range goal. A single

universally-used family of standards would make use of EDI more efficient and minimize aggregate costs of

use. Specifically, it would (a) minimize needs for training of personnel in use and maintenance of EDI

standards, (b) eliminate duplication of functionality and the costs of achieving that duplication now existing

in different systems of standards, (c) minimize requirements for different kinds of translation software, and

(d) allow for a universal set of data elements that would ease the flow of data among different but intercon¬

nected applications, and thereby maximize useful information interchange.

This FIPS PUB recognizes the reality that some families of EDI standards were developed to provide

solutions to immediate needs, and that inclusion of the goal of universality in their development would have

unacceptably delayed their availability. However, a future is envisioned in which the benefits of universality

outweigh the sunk costs in specialized solutions, leading first to cooperation among standards developers,

then to harmonization of standards, and eventually to a single universally accepted family of EDI standards.

3.5 Adoption of Specific Families of Standards. This FIPS PUB adopts, with specific conditions

specified below, the families of EDI standards known as XI2, UN/EDIFACT and HL7. This FIPS PUB does

not mandate the implementation of EDI systems within the Federal Government: rather it requires the use of

the identified families of standards with specified constraints when Federal departments or agencies imple¬

ment EDI systems.

The UN/EDIFACT standards may be used for any application, domestic or international. The XI2

standards may be used for any domestic application. The HL7 standards are adopted as an alternative for

certain healthcare applications, specifically for transmission of patient records and of clinical, epidemiologi¬

cal, and regulatory data. HL7 standards are not to be used for healthcare insurance administrative applica¬

tions, such as for enrollments, claims, and claim payments, or for any aspect of the Government procurement

cycle, such as for registration of vendors, RFQ, purchase order, shipping notice, or payment advice.

The cross-use of data elements is encouraged. A data element received through one system of EDI

standards, or through a non-EDI interchange, may be re-transmitted as a data element in any of the approved

systems of EDI standards.

The adopted standards were developed by the following organizations: the XI2 standards by Accredited

Standards Committee X12 on Electronic Data Interchange (ASC X12), accredited by the American National

Standards Institute (ANSI); the HL7 standards by Health Level Seven, Inc., an ANSI-accredited standards

developer; and the UN/EDIFACT standards by the United Nations (UN) Economic Commission for Europe—

Working Party (Four) on Facilitation of International Trade Procedures (UN/ECE/WP.4). Technical input from

the United States in the development of UN/EDIFACT at the UN is through the Pan American EDIFACT Board

(PAEB). The PAEB is separate from ASC XI2, and it serves as the coordinating body for national standards

organizations of North, Central, and South America.

3.6 Status of this FIPS PUB Revision. FIPS PUB 161-2 supersedes FIPS PUB 161-1 in its entirety.

FIPS PUB 161-2 contains editorial changes, updated references to documents and organizations, and new

guidance to agencies on the selection of national and international standards and implementation conven¬

tions. This guidance is based on recent voluntary industry standards activities and on the Federal Govern¬

ment initiative that commenced with the Presidential Memorandum of October 26,1993 entitled “Streamlining

Procurement Through Electronic Commerce.”

2
FIPS PUB 161-2

4. Approving Authority. Secretary of Commerce.

5. Maintenance Agency. U.S. Department of Commerce, National Institute of Standards and Technology

(NIST), Computer Systems Laboratory.

6. Cross Index and Related Documents.

6.1 Cross Index.

- FIPS PUB 146-2, Profiles for Open Systems Internetworking Technologies, May 1995.

6.2 Related Documents.

- ASC X12W/95-137, The ASC XI2 Plan for Technical Migration to and Administrative Alignment With

UN/EDIFACT (amended), May 8, 1995.

- NIST Special Publication 500-224, Stable Implementation Agreements for Open System Environ¬

ment, Version 8, Edition 1, December 1994.

- NIST Special Publication 800-9, Good Security Practices for Electronic Commerce, Including

Electronic Data Interchange, December 1993.

- Office of Management and Budget (OMB) Circular A-119 (revised), Federal Participation in the

Development and Use of Voluntary Standards, October 1993.

- UN/ECE/WP.4—Recommendation No. 25 on the Use of the UN/EDIFACT Standard, September

1995.

6.3 Sources of Documents. For the source of cited NIST publications, including FIPS PUBS, see

Section 13. For the source of X12, UN/EDIFACT and HL7 documents, see Subsection 10.1.

7. Objectives. The primary objectives of this standard are:

a. to ease the interchange of data sent electronically by use of common standards that allow for

automated message processing;

b. to promote the achievement of the benefits of EDI: reduced paperwork, fewer transcription errors,

faster response time for procurement and customer needs, reduced inventory requirements, more timely

payment of vendors, and closer coordination of data being processed on different computers for the same

application;

c. to promote migration to a universally used family of EDI standards, in order to further Government

efficiency and to minimize the cost of EDI implementation by preventing duplication of effort.

8. Applicability.

8.1 Conditions of Application. EDI may be employed with any type of operational data repre¬

sentable as a sequence of data elements that is needed to be transmitted or received on a repetitive basis

by a Federal agency in the course of its activities. This standard is applicable to the interchange of such data

on a particular subject within a Federal agency, or between a Federal agency and another organization

(which may be another Federal agency), if (1) the data are to be transmitted electronically or physically

transported between computers using EDI, and (2) the necessary standard messages meeting the data

requirements of the Federal agency for the subject of the interchange have been developed and approved,

and are acceptable for use under the conditions set forth in this FIPS PUB.

8.2 Subject Matter. Examples of applications (not necessarily the subject of current standards) are:

a. vendor search and selection: price/sales catalogs, bids, proposals, requests for quotations, notices

of contract solicitation, debarment data, trading partner profiles;

b. contract award: notices of award, purchase orders, purchase order acknowledgments, purchase

order changes;

c. product data: specifications, manufacturing instructions, reports of test results, safety data;

d. shipping, forwarding, and receiving: shipping manifests, bills of lading, shipping status reports,

receiving reports;

3
FIPS PUB 161-2

e. customs: release information: manifest update:

f. payment information: invoices, remittance advices, payment status inquiries, payment acknowledg¬

ments:

g. inventory control: stock level reports, resupply requests, warehouse activity reports:

h. maintenance: service schedules and activity, warranty data;

i. tax-related data: tax information and filings:

j. insurance-related data: health care claim; mortgage insurance application;

k. other government activities: communications license application; court conviction record; hazardous

material report; healthcare event report.

9. Coordination of Federal EDI Standards Development and Implementation.

9.1 Federal EDI Standards Management Coordinating Committee. There is established a

Federal EDI Standards Management Coordinating Committee (FESMCC). The FESMCC is established to

support the goal of a single face for the Federal Government to its trading partners in the use of EDI.

9.1.1 A responsibility of the FESMCC is the selection of implementation conventions (ICs) to be

used with EDI interchanges between the Federal Government and its trading partners. EDI messages (also

called transaction sets) are approved by standards committees with allowances for format options, in order

to widen the applicability of the standards to different uses. The purpose of ICs is to select specific options

in EDI standards so that interchanges are completely determined in format in advance of use.

9.1.2 The basic functions of the FESMCC are:

(a) to adopt Governmentwide ICs for use with EDI standards; the goal is adoption of one 1C for

each functional application of a message or transaction set within a given version/release of an EDI standard;

(b) to coordinate Federal agency participation in EDI standards bodies, to assure adequate consid¬

eration of the Government’s business needs and to assure consistency of position; and

(c) to share EDI information among agencies regarding current or planned implementations to

avoid duplicate efforts and streamline the process.

9.1.3 Voting membership in the FESMCC shall consist of, at minimum, one representative from

each participating Federal Executive Branch department and independent agency using or planning to use

EDI, plus a representative from NIST The FESMCC, under its charter and operating rules (see Subsection

9.1.5), may add additional voting representatives, including those from the other branches of the Federal

Government. The chair of the FESMCC shall be elected by its membership and approved by OMB.

9.1.4 The FESMCC shall establish a secretariat in order to maintain an official registry of approved

and draft ICs, provide controlled access to the registry including electronic remote access capability, provide

a point of contact for publicizing draft ICs and receiving comments on them, provide a single point for

submission of work requests to standards bodies, and for related functions.

9.1.5. The FESMCC shall establish a charter and operating rules to assist it in carrying out its

identified functions.

9.2 Functional Work Groups

9.2.1 The FESMCC may establish Functional Work Groups (FWGs) to consider and recommend

ICs in subject areas. Examples of subject areas are procurement, finance, logistics, and healthcare. Require¬

ments for voting membership shall be established by the FESMCC under its charter and operating rules. The

voting members shall elect a chair.

9.2.2 Each FWG shall recommend, to the full FESMCC, ICs that it has developed and approved

as meeting Federal Government and trading partner business requirements. FWGs should consult with

appropriate industry groups in the development of ICs.

9.3 Agency Responsibilities

9.3.1 Agencies shall register ICs that they are using with the FESMCC secretariat.

9.3.2 Agencies using X12, UN/EDIFACT, or HL7 versions and releases for which ICs have been

established by the FESMCC shall adopt those ICs. If an 1C does not meet business needs, requirements shall

4
FIPS PUB 161-2

be submitted to the FESMCC. ICs shall be classified as Implementer’s Agreements pursuant to this FIPS

PUB, but are not themselves FIPS PUBS.

9.3.3 Agencies using or planning to use EDI shall designate representatives to the FESMCC and

each relevant FWG.

9.3.4 Agencies requiring new EDI standards or changes to existing EDI standards to meet their

business needs shall submit their requirements to the appropriate standards bodies and shall simultaneously

submit their requirements to the FESMCC and relevant FWGs for coordination. Procedures and forms for

submission of new requirements through ASC XI2 are specified in Standing Document (SD) 2, Operations

Manual, and SD6, Operations Manual for UN/EDIFACT Standards. These manuals are available from Data

Interchange Standards Association, Inc. (DISA, Inc.). Procedures and forms for submission of new require¬

ments for UN/EDIFACT standards directly through the PAEB are also available from DISA, Inc. HL7 operating

procedures are specified in its bylaws, available from Health Level Seven, Inc.

10. Specifications. Documents are available that define the XI2, UN/EDIFACT, and HL7 standards and

provide information about the standards organizations and their standards development processes. Develop¬

ments are continuing in each of these families of standards.

10.1 Source of Documents. Documents concerning both the XI2 and UN/EDIFACT families of

standards are available from DISA, Inc., or from its named contractor. DISA, Inc., serves as the secretariat

for ASC XI2 and the PAEB and may be contacted at:

Address: Data Interchange Standards Association, Inc.

1800 Diagonal Road, Suite 200

Alexandria, VA 22314-2852

Phone: (703) 548-7005

A list of available standards publications, as well as descriptive material, prices and ordering procedures,

may be found in the most recent DISA, Inc., Publications Catalog.

HL7 documents are available from:

Address: Health Level Seven, Inc.

3300 Washtenaw Avenue, Suite 227

Ann Arbor, Ml 48104

Phone: (313)677-7777

10.2 ASC X12 Documents. XI2 standards are published periodically with revisions and updates,

and standards included in a publication may have one of two possible statuses:

(1) Draft Standards for Trial Use (DSTUs); these are fully approved by ASC X12, and are typically

published as “releases” at one-year intervals. DSTU Version 3, Release 4, identified as 003040,

was published in December 1993; Version 3, Release 5, identified as 003050, was published in

December 1994. The next release, identified as 003060, is available as of January 1996.

(2) American National Standards (ANSs); these are fully approved by ASC XI2 and by ANSI, and are

typically published as ‘Versions” at intervals of three to five years. ANS Version 3, March 1992, is

functionally equivalent to DSTU Version 2, Release 4. It is expected that ANS Version 4, planned

for 1997, will be functionally equivalent to DSTU Version 3, Release 7, identified as 003070.

10.3 UN/EDIFACT Documents. UN/EDIFACT standards are published periodically with revisions

and updates, and standards included in a publication may have one of two possible statuses:

(1) Status 1, approved for trial use. A set of documents identified as UN/EDIFACT Draft Messages and

Directories, Version D.95A, was published in May 1995. This document also included Status 2

messages. A new set of standards, identified as D.95B and also including Status 2 messages, was

approved in September 1995.

5
FIPS PUB 161-2

(2)Status 2, fully approved by UN/ECE/WP.4. The set of Status 2 documents may be referred to as the

UN Trade Data Interchange Directory (UNTDID). The last published version of Status 2 standards

only, S.93A, was issued in May 1994. See also Subsection 11.4 for additional information on

UN/EDIFACT Status 2.

10.4 HL7 Documents. HL7 standards are published as a single volume. The current set is Version

2.2, published December 1994. A new Version 2.3 is planned for Fall 1996. HL7 standards also have one of

two possible statuses:

(1) HL7 standards, approved by the membership of HL7 but not yet approved by ANSI.

(2) American National Standards (ANSs); these are fully approved by HL7 and by ANSI.

11. Implementation.

11.1 Schedule for Adoption. FIPS PUB 161 was effective on September 30, 1991. Federal agen¬

cies that are not using EDI for subject matter for which XI2, UN/EDIFACT, and HL7 standards have been

approved and issued shall utilize only those standards in EDI systems that they procure or develop, subject

to the qualifications of Subsections 3.5, 11.3, 11.4 and 11.5. Agencies that are using those standards shall

continue to do so, subject to the same qualifications. Agencies that were using other standards on or after

September 30, 1991 shall be governed by Subsection 11.6.

11.2 Acceptance of UN/EDIFACT by ASC XI2. In January 1995, ASC XI2, by a membership vote,

approved the ASC XI2 Plan For Technical Migration To And Administrative Alignment With UN/EDIFACT.

This plan was modified at the February 1995 plenary meeting of ASC XI2. Key features of the modified

Alignment Plan are:

(1) Draft standards based on XI2 syntax or on UN/EDIFACT syntax may be submitted by ASC XI2 to

ANSI for processing as ANSs.

(2) XI2 Release 003070 shall form the basis of Version 4 of draft proposed XI2 American National

Standards (ANSs).

(3) After the release of Version 4, ASC XI2 shall continue for a period of time, in accordance with the

plan, to develop, maintain, approve and publish XI2-syntax transaction sets and supporting

documents.

(4) An ASC XI2 ballot shall be conducted in 1998 to determine if XI2-syntax transaction set develop¬

ment should be terminated. If the ballot for termination is not approved, a three-year repeating cycle

shall occur thereafter, until no new XI2-syntax transaction sets are being developed.

11.3 Selection of a Family of Standards.

11.3.1 Different families of EDI standards are distinct, although performing similar functions: the

existence of one does not preclude the others. Equivalent functionality may be obtained in any system by the

addition, if required, of new or revised message formats and data elements. Software that assembles and

disassembles messages and transaction sets, called translation software, is widely available, often for more

than one system in the same package. In selecting a family of standards for domestic applications, agencies

should attempt to maximize Government economy and efficiency and to minimize the costs imposed on U.S.

businesses.

11.3.2 For any domestic application with a non-Government partner, and for related intraGovernment applications, selection of a family of standards shall take into account the prevailing family used

in the industry of the interchange partners for the application. However, UN/EDIFACT standards shall be

employed for new or significantly upgraded interchanges in the absence of demonstrably higher costs, or at

the request of interchange partners providing a significant fraction of interchange traffic. Continued long-term

use and maintenance of more than one family of standards is unacceptably inefficient.

11.3.3 For international applications except as specified in Subsection 11.3.4, planning for migra¬

tion to the UN/EDIFACT family of standards shall commence at this time if that family is not currently being

6
FIPS PUB 161-2

used. A timetable for conversion to UN/EDI FACT of existing international implementations shall be set as

applicable standards and software become available. New or significantly upgraded interchanges shall

employ only standards using UN/EDIFACT.

11.3.4 The HL7 family of standards may be used for international applications in the fields of public

health and health regulatory information, pursuant to agreements of international organizations whose

membership includes representation of national or multi-national governmental health agencies. However,

users shall coordinate with the developers of UN/EDIFACT, in order to prevent duplication of effort, provide

for cross-use of data elements, and provide a path for harmonization and eventual migration or coalescence.

11.4 Use of Category (1) Standards. UN/EDIFACT Status 1 standards, XI2 DSTUs, and HL7

standards not yet approved by ANSI are defined as Category (1) standards. UN/EDIFACT Status 2 standards

and ANSs submitted by ASC XI2 and HL7 are defined as Category (2) standards. Federal agencies shall

use only Category (1) or Category (2) standards for EDI implementations. Industry practice is to use Category

(1) standards; these represent the latest consensus and are available sooner than the corresponding full

standards of Category (2). Consequently, Category (1) standards are preferred, but not mandated at this

time. Note: there is a possibility that UN/EDIFACT Status 2 standards will be eliminated by UN/ECE/WP.4.

In that case, UN/EDIFACT Status 1 standards would be required when UN/EDIFACT is implemented.

11.5 Continued Use of Existing Approved Implementations. An existing implementation of any

version of an approved standard specified in Subsections 3.5,11.3 and 11.4 may continue to be used as long

as it continues to meet the business needs of the using agency and its interchange partners. Significant

upgrades of existing implementations shall be to versions and releases for which ICs have been approved

by the FESMCC, if any are available.

11.6 Continued Use of Other EDI Standards. Under the initial issue of this FIPS, Federal agencies

using “industry-specific” EDI standards were permitted to use those standards for five years from September

30, 1991, i.e., until September 30, 1996. Agencies were permitted to use “industry-specific" EDI standards

beyond five years only if no equivalent XI2 or UN/EDIFACT standards, as appropriate, were approved and

issued by September 30, 1995. If an equivalent and appropriate standard were issued after the latter date,

agencies were given one year to convert. These provisions remain in effect for all application areas except

healthcare.

For healthcare applications, agencies may use EDI standards other than UN/EDIFACT, XI2, or HL7

through September 30,1997. Other standards may be used beyond that date only if no functionally equivalent

standards that meet the conditions of use specified in Subsections 3.5, 11.3 and 11.4 are approved and

issued by September 30, 1996. If a Category (1) standard meeting business requirements and allowable

conditions of use is first issued after the latter date, agencies have one year to convert following the issuance

of the release containing the implementable standard.

Requirements for submission of proposed new or revised standards are specified in Subsection 9.3.4.

11.7 Security and Authentication. Agencies shall employ risk management techniques to deter¬

mine the appropriate mix of security controls needed to protect specific data and systems. The selection of

controls shall take into account procedures required under applicable laws and regulations.

Optional tools and techniques for implementation of security and authentication may be provided by ASC

X12 and UN/ECE/WP.4 for use in connection with their respective families of standards. Agencies may utilize

these tools and techniques, and/or they may utilize other methods in systems supporting the EDI data

interchange. Methods and procedures implemented shall be consistent with applicable FIPS PUBS and

guidance documents issued by NIST.

12. Waivers. Under certain exceptional circumstances, the heads of Federal departments and agencies

may approve waivers to Federal Information Processing Standards (FIPS). The head of such agency may

redelegate such authority only to a senior official designated pursuant to Section 3506(a) of Title 44, U.S.

Code. Waivers shall be granted only when:

a. Compliance with a standard would adversely affect the accomplishment of the mission of an oper¬

ator of a Federal computer system, or

b. Cause a major adverse financial impact on the operator which is not offset by Governmentwide

savings.

7
FIPS PUB 161-2

Agency heads may act upon a written waiver request containing the information detailed above. Agency

heads may also act without a written waiver request when they determine that conditions for meeting the

standard cannot be met. Agency heads may approve waivers only by a written decision which explains the

basis on which the agency head made the required finding(s). A copy of each such decision, with procure¬

ment sensitive or classified portions clearly identified, shall be sent to: National Institute of Standards and

Technology: Attn: FIPS Waiver Decisions, Building 820, Room 509; Gaithersburg, MD 20899.

In addition, notice of each waiver granted and each delegation of authority to approve waivers shall be

sent promptly to the Committee on Government Reform and Oversight of the House of Representatives and

the Committee on Governmental Affairs of the Senate and shall be published promptly in the Federal

Register.

When the determination on a waiver applies to the procurement of equipment and/or services, a notice

of the waiver determination must be published in the Commerce Business Daily as part of the notice of

solicitation for offers of an acquisition or, if the waiver determination is made after that notice is published,

by amendment to such notice.

A copy of the waiver, any supporting documents, the document approving the waiver and any supporting

and accompanying documents, with such deletions as the agency is authorized and decides to make under

5 U.S.C. Sec. 552(b), shall be part of the procurement documentation and retained by the agency.

13. Where to Obtain Copies of NIST Publications. Copies of this publication and NIST publications

referenced in Section 6 are for sale by the National Technical Information Service (NTIS), U.S. Department

of Commerce, Springfield, VA 22161; phone (703) 487-4650. When ordering this publication, refer to Federal

Information Processing Standards Publication 161-2 (FIPSPUB161-2), and title. Payment may be made by

check, money order, or NTIS deposit account.

8
*
U.S. Department of Commerce

National Technical Information Service5285 Port Royal RoadSpringfield, VA 22161

)))

cn~

<x> to C g

"w qI

CDo

03o ro

cz

^ a> O Cl