Report the costs of security and show how the security plan is partof the life-cycle of the system. Develop a security plan that includes thesecurity rules for the system and the consequences of violating the rulesand a way to identify, limit and control connections to other systems. Identify security risks and how risks will be assessed and minimized. Demonstrate how security controls are commensurate with the risk. Use appropriate security for systems that permit public access.
Ensurepersonal information is consistent with relevant federal policies.
Account for departures from National Institute for Standards andTechnology guidance. At the time, officials blamed the contract's poor performance on lackof security funding and agencies' lack of commitment to security. But that may be changing.