Under the Government Network Security Act of 2003 , federal agencies would have six months to develop and implement P2P security plans .