curity Act of 1987 (40 U.S.C. 759 note), and relat-
ed information management laws; and
‘‘(3) consistent with the Computer Security Act
of 1987 (40 U.S.C. 759 note), identify and afford
security protections commensurate with the risk and
magnitude of the harm resulting from the loss, mis-
use, or unauthorized access to or modification of in-
formation collected or maintained by or on behalf of
an agency.
‘‘(h) With respect to Federal information technology,
each agency shall—
‘‘(1) implement and enforce applicable Govern-
mentwide and agency information technology man-
agement policies, principles, standards, and guide-
lines;
‘‘(2) assume responsibility and accountability
for information technology investments;
‘‘(3) promote the use of information technology
by the agency to improve the productivity, efficiency,
and effectiveness of agency programs, including the
reduction of information collection burdens on the
public and improved dissemination of public infor-
mation;
‘‘(4) propose changes in legislation, regulations,
and agency procedures to improve information tech-
nology practices, including changes that improve the
ability of the agency to use technology to reduce
burden; and
‘‘(5) assume responsibility for maximizing the
value and assessing and managing the risks of major
information systems initiatives through a process
that is—
‘‘(A) integrated with budget, financial, and
program management decisions; and
‘‘(B) used to select, control, and evaluate
the results of major information systems initia-
tives.
‘‘§ 3507. Public information collection activities; sub-
mission to Director; approval and delega-
tion
‘‘(a) An agency shall not conduct or sponsor the col-
lection of information unless in advance of the adoption
or revision of the collection of information—
‘‘(1) the agency has—
‘‘(A) conducted the review established
under section 3506(c)(1);
‘‘(B) evaluated the public comments re-
ceived under section 3506(c)(2);
‘‘(C) submitted to the Director the certifi-
cation required under section 3506(c)(3), the
proposed collection of information, copies of
pertinent statutory authority, regulations, and
other related materials as the Director may
specify; and
‘‘(D) published a notice in the Federal
Register—
‘‘(i) stating that the agency has made
such submission; and
‘‘(ii) setting forth—
‘‘(I) a title for the collection of
information;
‘‘(II) a summary of the collection
of information;
‘‘(III) a brief description of the
need for the information and the pro-
posed use of the information;
‘‘(IV) a description of the likely
respondents and proposed frequency
of response to the collection of infor-
mation;
‘‘(V) an estimate of the burden
that shall result from the collection of
information; and
‘‘(VI) notice that comments may
be submitted to the agency and Direc-
tor;
‘‘(2) the Director has approved the proposed
collection of information or approval has been in-
ferred, under the provisions of this section; and
‘‘(3) the agency has obtained from the Director
a control number to be displayed upon the collection
of information.
‘‘(b) The Director shall provide at least 30 days for
public comment prior to making a decision under sub-
section (c), (d), or (h), except for good cause or as pro-
vided under subsection (j).
‘‘(c)(1) For any proposed collection of information
not contained in a proposed rule, the Director shall notify
the agency involved of the decision to approve or dis-
approve the proposed collection of information.
‘‘(2) The Director shall provide the notification under
paragraph (1), within 60 days after receipt or publication
of the notice under subsection (a)(1)(D), whichever is
later.
‘‘(3) If the Director does not notify the agency of a
denial or approval within the 60-day period described
under paragraph (2)—
‘‘(A) the approval may be inferred;