United States Government Publishing Office publisher pbl distributor dst United States National Archives and Records Administration Office of the Federal Register author aut Government Organization text government publication eng FR Regulatory Information 1996_register executive 2010-09-24 article Part III Notices D09002ee1be050d5d D09002ee1be050dd9 United States Office of Management and Budget originator org United States Government Agency or Subagency The Office of Management and Budget (OMB) is revising Appendix III, ``Security of Federal Information Systems,'' of Circular No. A- 130, ``Management of Federal Automated Information Resources.'' This is the third stage of planned revisions to Circular A-130. Enactment of the Information Technology Management Reform Act of 1996 (Division E of the National Defense Authorization Act for Fiscal Year 1996) will require OMB to issue additional guidance on capital planning, investment control, and the management of information technology. A plan for those revisions will be announced in the Spring. Transmittal 1 to Circular A-130, effective June 25, 1993, and published on July 2, 1993 (58 FR 36068) addressed the Information Management Policy section of the Circular (Section 8a), as well as Appendix I, ``Federal Agency Responsibilities for Maintaining Records About Individuals.'' That issuance dealt primarily with how the Federal government manages its information holdings, particularly information exchange with the public. Transmittal 2 to Circular A-130, effective July 15, 1994, and published on July 25, 1994 (59 FR 37906) addressed agency management practices for information systems and information technology (Section 8b). That issuance was intended to (1) promote agency investments in information technology that improve service delivery to the public, reduce burden on the public, and lower the cost of Federal programs administration, and (2) encourage agencies to use information technology as a strategic resource to improve Federal work processes and organization. This Transmittal 3 is intended to guide agencies in securing government information resources as they increasingly rely on an open and interconnected National Information Infrastructure. It stresses management controls, such as individual responsibility, awareness and training, and accountability, and explains how they can be supported by technical controls. Among other things, it requires agencies to assure that risk-based rules of behavior are established, that employees are trained in them, and that the rules are enforced. The revision also integrates security into program and mission goals, reduces the centralized reporting of security plans, emphasizes the management of risk rather than its measurement, and revises government-wide security responsibilities to be consistent with the Computer Security Act and the Paperwork Reduction Act of 1995. This transmittal also makes minor technical revisions to Section 9 (``Assignment of Responsibilities'') and Section 10 (``Oversight'') to reflect the Paperwork Reduction Act of 1995 (Pub. L. 104-13). One substantive change has been made to Appendix I in Section 3.a. changing the annual requirement to review recordkeeping practices, training, violations, and notices to a biennial review, in accordance with other regular agency reviews not required by statute. Several minor changes have been made, none of which are intended to be substantive. In Section 2.c., a portion of the definition of ``nonfederal agency'' which has been inadvertently omitted has been added to reflect the current practice in state-federal matching programs. In Section 3.a., extraneous and confusing language referring to source or matching agencies was removed because the provision applies to any agency that participates in a matching program. The example's in 4.c.(1) were updated for clarity. Other editorial and organizational changes were made throughout the appendix. Appendix IV has been changed to include material from OMB Memorandum M-95-22, ``Implementing the Information Dissemination Provisions of the Paperwork Reduction Act of 1995'' (September 29, 1995), and to delete some outdated or otherwise already implemented guidance from the discussion of Sections 9 and 10. 61 FR 6428 https://www.govinfo.gov/app/details/FR-1996-02-20/96-3645 96-3645 fr20fe96-118 3110-01-P https://www.govinfo.gov/app/details/FR-1996-02-20/96-3645 https://www.govinfo.gov/content/pkg/FR-1996-02-20/html/96-3645.htm https://www.govinfo.gov/content/pkg/FR-1996-02-20/pdf/96-3645.pdf 26 p. 6428 6453 61 FR 6428 Management of Federal Information Resources; Federal Register Vol. 61, Issue NOTICE 96-3645 III OFFICE OF MANAGEMENT AND BUDGET 3110-01-P 96-3645 Revision of OMB Circular No. A-130, Transmittal No. 3, Appendix III, ``Security of Federal Automated Information Resources.''

The Office of Management and Budget (OMB) is revising Appendix III, ``Security of Federal Information Systems,'' of Circular No. A- 130, ``Management of Federal Automated Information Resources.'' This is the third stage of planned revisions to Circular A-130. Enactment of the Information Technology Management Reform Act of 1996 (Division E of the National Defense Authorization Act for Fiscal Year 1996) will require OMB to issue additional guidance on capital planning, investment control, and the management of information technology. A plan for those revisions will be announced in the Spring. Transmittal 1 to Circular A-130, effective June 25, 1993, and published on July 2, 1993 (58 FR 36068) addressed the Information Management Policy section of the Circular (Section 8a), as well as Appendix I, ``Federal Agency Responsibilities for Maintaining Records About Individuals.'' That issuance dealt primarily with how the Federal government manages its information holdings, particularly information exchange with the public. Transmittal 2 to Circular A-130, effective July 15, 1994, and published on July 25, 1994 (59 FR 37906) addressed agency management practices for information systems and information technology (Section 8b). That issuance was intended to (1) promote agency investments in information technology that improve service delivery to the public, reduce burden on the public, and lower the cost of Federal programs administration, and (2) encourage agencies to use information technology as a strategic resource to improve Federal work processes and organization. This Transmittal 3 is intended to guide agencies in securing government information resources as they increasingly rely on an open and interconnected National Information Infrastructure. It stresses management controls, such as individual responsibility, awareness and training, and accountability, and explains how they can be supported by technical controls. Among other things, it requires agencies to assure that risk-based rules of behavior are established, that employees are trained in them, and that the rules are enforced. The revision also integrates security into program and mission goals, reduces the centralized reporting of security plans, emphasizes the management of risk rather than its measurement, and revises government-wide security responsibilities to be consistent with the Computer Security Act and the Paperwork Reduction Act of 1995. This transmittal also makes minor technical revisions to Section 9 (``Assignment of Responsibilities'') and Section 10 (``Oversight'') to reflect the Paperwork Reduction Act of 1995 (Pub. L. 104-13). One substantive change has been made to Appendix I in Section 3.a. changing the annual requirement to review recordkeeping practices, training, violations, and notices to a biennial review, in accordance with other regular agency reviews not required by statute. Several minor changes have been made, none of which are intended to be substantive. In Section 2.c., a portion of the definition of ``nonfederal agency'' which has been inadvertently omitted has been added to reflect the current practice in state-federal matching programs. In Section 3.a., extraneous and confusing language referring to source or matching agencies was removed because the provision applies to any agency that participates in a matching program. The example's in 4.c.(1) were updated for clarity. Other editorial and organizational changes were made throughout the appendix. Appendix IV has been changed to include material from OMB Memorandum M-95-22, ``Implementing the Information Dissemination Provisions of the Paperwork Reduction Act of 1995'' (September 29, 1995), and to delete some outdated or otherwise already implemented guidance from the discussion of Sections 9 and 10.

OMB will review this Circular three years from the date of issuance to ascertain its effectiveness. Information Policy and Technology Branch, Office of Information and Regulatory Affairs, Office of Management and Budget, Room 10236, New Executive Office Building, Washington, D.C. 20503. Telephone: (202) 395-3785. Vol. 61, no. 34 Office of the Federal Register, National Archives and Records Administration 1996-02-20 continuing daily deposited born digital 195 p. Table of Contents: AE 2.7: GS 4.107: AE 2.106: KF70.A2 https://www.govinfo.gov/app/details/FR-1996-02-20 P0b002ee180a2b001 0097-6326 0042-1219 0364-1406 769-004-00000-9 000582072 f:fr20fe96 https://www.govinfo.gov/app/details/FR-1996-02-20 https://www.govinfo.gov/content/pkg/FR-1996-02-20/pdf/FR-1996-02-20.pdf fdlp 6305 6486 DGPO 2010-09-24 2023-05-07 FR-1996-02-20 machine generated eng FR FR-1996-02-20 61 34