Source: http://csrc.nist.gov/groups/SMA/fasp/documents/incident_response/SSAIRBSP/m_01_08_memo_implement_security_act_jan_2001.html
Timestamp: 2014-04-25 01:02:12
Document Index: 616372783

Matched Legal Cases: ['art 2', 'art 3', 'art 4', 'art 5', 'art 6', 'art 1']

M-01-08, Memorandum for Heads of Departments and Agencies re: Guidance On Implementing the Government Information Security Reform Act, January 16, 2001 (OMB)
M-01-08
Guidance On Implementing the Government Information Security Reform Act On October 30, 2000, the President signed into law the FY 2001 Defense Authorization Act (P.L. 106-398) including Title X, subtitle G, "Government Information Security Reform." It amends the Paperwork Reduction Act (PRA) of 1995 by enacting a new subchapter on "Information Security." The Act primarily addresses the program management and evaluation aspects of security. It covers unclassified and national security systems and creates the same management framework for each. At the policy level, the two types of systems remain separate. The Act became effective on November 29th and sunsets in two years.
The attachment provides guidance to agencies on carrying out the Act. The guidance focuses on unclassified Federal systems and addresses only those areas of the legislation that introduce new or modified requirements. The Act requires for both unclassified and national security programs: 1) annual agency program reviews; 2) annual Inspector General (IG) evaluations; 3) agency reporting to OMB the results of IG evaluations for unclassified systems and audits of IG evaluations for national security programs; and 4) an annual OMB report to Congress summarizing the materials received from agencies. Agencies will submit this information beginning in 2001 as part of the budget process.
This Act seeks to ensure proper management and security for the information resources supporting Federal operations and assets. It is particularly important as we move towards a more effective electronic government. Please direct any questions about this guidance to Kamela White in the Office of Management and Budget at 202-395-3630, kgwhite@omb.eop.gov.
Guidance On Implementing the Government Information Security Reform Act Title X, subtitle G of the 2001 Defense Authorization Act (P.L. 106-398)
How does the Security Act affect existing security policy and authorities? Does the Security Act pertain to existing agency systems? Does the Security Act pertain to contractor systems? How does the Security Act's new definition of "mission critical system" affect agency security responsibilities? What is the relationship between the new Security Act and PDD-63, "Critical Infrastructure Protection?" What are the relationships between the agency-wide security program and agency-wide security plan? Who is responsible for these and do individual systems still require security plans? Part 2: Agency Responsibilities
What new agency responsibilities are found in the Security Act? What are the responsibilities of the agency head? What are the responsibilities of program officials? What are the responsibilities of the agency Chief Information Officer? Part 3: Inspector General Responsibilities
What are the responsibilities of the agency Inspector General? Part 4: OMB Responsibilities
What are OMB's responsibilities under the Security Act? Will OMB be revising its security policies? Part 5: Reporting Requirements
What does the Security Act require agencies to report? What does the Security Act require OMB to report? Part 6: Additional Responsibilities of Certain Agencies
Department of Commerce Department of Defense and the Intelligence Community Department of Justice General Services Administration Office of Personnel Management Part 1: General Overview
On October 30, 2000, the President signed into law the FY 2001 Defense Authorization Act (P.L. 106-398) including Title X, subtitle G, "Government Information Security Reform (The Security Act)." The Security Act was effective on November 29th and sunsets in two years.
The Security Act amends the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. Chapter 35), by enacting a new subchapter on "Information Security" which primarily addresses the program management and evaluation aspects of security. This Act applies to all agencies covered by the PRA. It covers programs for both unclassified and national security systems and within the agencies creates the same management framework for each. At the policy level, the two programs remain separate. The Security Act requires annual agency program reviews, annual Inspector General security evaluations, agency reporting to OMB, and an annual OMB report to Congress. The following guidance focuses on unclassified Federal systems and addresses only those areas of the legislation that introduce new or modified requirements or that otherwise benefit from clarification. In several locations, this guidance refers to some of the Security Act's provisions for national security systems. Unless otherwise specified, implementation of those provisions will be consistent with existing Presidential directives regarding national security information and systems.
A. How does the Security Act affect existing security policy and authorities?
For unclassified systems, OMB retains its existing policy authority under the PRA and the Clinger-Cohen Act of 1996. Except for the new annual program reviews, the role of the agency Inspector General, and the annual reporting requirement, the Security Act essentially codifies the existing requirements of OMB Circular A-130, Appendix III, "Security of Federal Automated Information Resources." The Security Act also requires agencies to incorporate security into the life cycle of agency information systems. For guidance on meeting this requirement, see OMB Memorandum 00-07, "Incorporating and Funding Security in Information Systems Investments," now incorporated into Section 8b(3) of OMB Circular A-130 (65 FR 77677; December 12, 2000). See, www.cio.gov/docs/Recompiled_A-1301.htm.