To address computer security in today's environments, users and managers need a framework which can handle a myriad of technological possibilities. General support systems are normally a collection of computers, networks, and other IT components. The lines that separate general support systems from each other are often managerial rather than physical or electronic. A major application is a critical business or mission resource. In government organizations, a typical major application is providing citizen benefits.
Agencies are most able to identify their major applications.
Rather, consistent with the Computer Security Act of 1987, the Circular recognizes that systems are procured and operated to serve particular agency needs of varying sensitivity and criticality. All general support systems contain some sensitive information and, therefore, require protection, including a security plan. This should help prevent arguments about what is sensitive and allow that energy to be spent securing systems. In most organizations, it is appropriate to delegate decisions about computer security to line managers and to retain agency- level control of major applications. The goal of this process is to create management accountability for security decisions and implementation.