February 28, 2000
M-00-07
MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES
| FROM: |
Jacob J. Lew
Director |
| | |
| SUBJECT: |
Incorporating and Funding Security in Information Systems Investments |
This memorandum reminds agencies of the Office of Management and Budget's (OMB)
principles for incorporating and funding security as part of agency information technology
systems and architectures and of the decision criteria that will be used to evaluate security for
information systems investments. The principles and decision criteria are designed to highlight
our existing policy and thereby foster improved compliance with existing security obligations;
this memorandum does not constitute new security policy. OMB plans to use the principles as
part of the FY 2002 budget process to determine whether an agency's information systems
investments include adequate security plans.
Protecting the information and systems that the Federal government depends on is important as
agencies increasingly rely on new technology. Agencies are working to preserve the integrity,
reliability, availability, and confidentiality of important information while maintaining their
information systems. The most effective way to protect information and systems is to
incorporate security into the architecture of each. This approach ensures that security supports
agency business operations, thus facilitating those operations, and that plans to fund and manage
security are built into life-cycle budgets for information systems.
This memorandum is written pursuant to the Information Technology Management Reform Act
(the Clinger-Cohen Act) which directs OMB to develop, as part of the budget process, a
mechanism to analyze, track, and evaluate the risks and results of major capital investments made
by an executive agency for information systems. Additionally, the Clinger-Cohen Act calls for
OMB to issue clear and concise direction to ensure that the information security policies,
processes, and practices of the agencies are adequate. These criteria will be incorporated into
future revisions of OMB Circular A-130 ("Management of Federal Information Resources") and
should be used in conjunction with previous OMB guidance on sound capital planning and
investment control in OMB Memorandum 97-02, "Funding Information Systems Investments";
OMB Memorandum 97-16, "Information Technology Architectures"; and subsequent updates.
Security programs and controls implemented under this memorandum should be consistent with
the Computer Security Act, the Paperwork Reduction Act, the Clinger-Cohen Act, and OMB
Circular A-130. They should also be consistent with security guidance issued by the National
Institute of Standards and Technology (NIST). Security controls for national security
telecommunications and information systems should be implemented in accordance with
appropriate national security directives.
Principles
The principles outlined below will support more effective agency implementation of both agency
computer security and critical information infrastructure protection programs. In terms of Federal
information systems, critical infrastructure protection starts with an effort to prioritize key
systems (e.g., those that are most critical to agency operations). Once systems are prioritized,
agencies apply OMB policies and, for non-national security applications, NIST guidance to
achieve adequate security commensurate with the level of risk and magnitude of likely harm.
Agencies should develop security programs and incorporate security and privacy into information
systems with attention to the following principles:
- Effective security is an essential element of all information systems.
- Effective privacy protections are essential to all information systems, especially those that
contain substantial amounts of personally identifiable information. The use of new
information technologies should sustain, and not erode, the privacy protections provided in all
statutes and policies relating to the collection, use, and disclosure of personal information.
- The increase in efficiency and effectiveness that flows from the use of interconnected
computers and networks has been accompanied by increased risks and potential magnitude of
loss. The protection of Federal computer resources must be commensurate with the risk of
harm resulting from any misuse or unauthorized access to such systems and the information
flowing through them.
- Security risks and incidents must be managed in a way that complements and does not
unnecessarily impede agency business operations. By understanding risks and implementing
an appropriate level of cost-effective controls, agencies can reduce risk and potential loss
significantly.
- A strategy to manage security is essential. Such a strategy should be based on an ongoing
cycle of risk management and should be developed in coordination with and implemented by
agency program officials. It should identify significant risks, clearly establish responsibility
for reducing them, and ensure that risk management remains effective over time.
- Agency program officials must understand the risk to systems under their control and
determine the acceptable level of risk, ensure that adequate security is maintained to support
and assist the programs under their control, and ensure that security controls comport with
program needs and appropriately accommodate operational necessities. In addition, program
officials should work in conjunction with Chief Information Officers and other appropriate
agency officials so that security measures support agency information architectures.
Policy
Security should be built into and funded as part of the system architecture. Agencies should make
security's role explicit in information technology investments and capital programming. These
actions are entirely consistent with and build upon the principles outlined in OMB Memorandum
97-02. Accordingly, investments in the development of new or the continued operation of
existing information systems, both general support systems and major applications, proposed for
funding in the President's budget must:
1. Be tied to the agency's information architecture. Proposals should demonstrate that the
security controls for components, applications, and systems are consistent with and an integral
part of the information technology architecture of the agency.
2. Be well-planned, by:
a) Demonstrating that the costs of security controls are understood and are explicitly
incorporated in the life-cycle planning of the overall system in a manner consistent with
OMB guidance for capital programming.
b) Incorporating a security plan that discusses:
- the rules of behavior for the system and the consequences for violating those rules;
- personnel and technical controls for the system;
- methods for identifying, appropriately limiting, and controlling interconnections with other
systems and specific ways such limits will be monitored and managed;
- procedures for the on-going training of individuals that are permitted access to the system;
- procedures for the on-going monitoring of the effectiveness of security controls;
- procedures for reporting and sharing with appropriate agency and government authorities
indications of attempted and successful intrusions into agency systems;
- provisions for the continuity of support in the event of system disruption or failure.
3. Manage risks, by:
a) Demonstrating specific methods used to ensure that risks and the potential for loss are
understood and continually assessed, that steps are taken to maintain risk at an acceptable
level, and that procedures are in place to ensure that controls are implemented effectively
and remain effective over time.
b) Demonstrating specific methods used to ensure that the security controls are
commensurate with the risk and magnitude of harm that may result from the loss, misuse,
or unauthorized access to or modification of the system itself or the information it
manages.
c) Identifying additional security controls that are necessary to minimize risks to and
potential loss from those systems that promote or permit public access, other externally
accessible systems, and those systems that are interconnected with systems over which
program officials have little or no control.
4. Protect privacy and confidentiality, by:
a) Deploying effective security controls and authentication tools consistent with the
protection of privacy, such as public-key based digital signatures, for those systems that
promote or permit public access.
b) Ensuring that the handling of personal information is consistent with relevant
government-wide and agency policies, such as privacy statements on the agency's web
sites.
5. Account for departures from NIST Guidance. For non-national security applications, to
ensure the use of risk-based cost-effective security controls, describe each occasion when
employing standards and guidance that are more stringent than those promulgated by the National
Institute for Standards and Technology.
In general, OMB will consider new or continued funding only for those system investments that
satisfy these criteria and will consider funding information technology investments only upon
demonstration that existing agency systems meet these criteria. Agencies should begin now to
identify any existing systems that do not meet these decision criteria. They should then work
with their OMB representatives to arrive at a reasonable process and timetable to bring such
systems into compliance. Agencies should begin with externally accessible systems and those
interconnected systems that are critical to agency operations. OMB staff are available to work
with you if you or your staff have questions or need further assistance in meeting these
requirements.
The Budget | Legislative Information | Management Reform/GPRA
Grants Management
Financial Management | Procurement Policy | Information & Regulatory Policy
Contact the White House Web Master
Privacy Statement | 
