February 28, 2000

M-00-07

MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES

From: Jacob J. Lew
Director

Subject: Incorporating and Funding Security in Information Systems Investments

This memorandum reminds agencies of the Office of Management and Budget's (OMB) principles for incorporating and funding security as part of agency information technology systems and architectures and of the decision criteria that will be used to evaluate security for information systems investments. The principles and decision criteria are designed to highlight our existing policy and thereby foster improved compliance with existing security obligations; this memorandum does not constitute new security policy. OMB plans to use the principles as part of the FY 2002 budget process to determine whether an agency's information systems investments include adequate security plans.

Protecting the information and systems that the Federal government depends on is important as agencies increasingly rely on new technology. Agencies are working to preserve the integrity, reliability, availability, and confidentiality of important information while maintaining their information systems. The most effective way to protect information and systems is to incorporate security into the architecture of each. This approach ensures that security supports agency business operations, thus facilitating those operations, and that plans to fund and manage security are built into life-cycle budgets for information systems.

This memorandum is written pursuant to the Information Technology Management Reform Act (the Clinger-Cohen Act) which directs OMB to develop, as part of the budget process, a mechanism to analyze, track, and evaluate the risks and results of major capital investments made by an executive agency for information systems. Additionally, the Clinger-Cohen Act calls for OMB to issue clear and concise direction to ensure that the information security policies, processes, and practices of the agencies are adequate. These criteria will be incorporated into future revisions of OMB Circular A-130 ("Management of Federal Information Resources") and should be used in conjunction with previous OMB guidance on sound capital planning and investment control in OMB Memorandum 97-02, "Funding Information Systems Investments"; OMB Memorandum 97-16, "Information Technology Architectures"; and subsequent updates.

Security programs and controls implemented under this memorandum should be consistent with the Computer Security Act, the Paperwork Reduction Act, the Clinger-Cohen Act, and OMB Circular A-130. They should also be consistent with security guidance issued by the National Institute of Standards and Technology (NIST). Security controls for national security telecommunications and information systems should be implemented in accordance with appropriate national security directives.

Principles

The principles outlined below will support more effective agency implementation of both agency computer security and critical information infrastructure protection programs. In terms of Federal information systems, critical infrastructure protection starts with an effort to prioritize key systems (e.g., those that are most critical to agency operations). Once systems are prioritized, agencies apply OMB policies and, for non-national security applications, NIST guidance to achieve adequate security commensurate with the level of risk and magnitude of likely harm.

Agencies should develop security programs and incorporate security and privacy into information systems with attention to the following principles:

· Effective security is an essential element of all information systems.

· Effective privacy protections are essential to all information systems, especially those that contain substantial amounts of personally identifiable information. The use of new information technologies should sustain, and not erode, the privacy protections provided in all statutes and policies relating to the collection, use, and disclosure of personal information.

· The increase in efficiency and effectiveness that flows from the use of interconnected computers and networks has been accompanied by increased risks and potential magnitude of loss. The protection of Federal computer resources must be commensurate with the risk of harm resulting from any misuse or unauthorized access to such systems and the information flowing through them.

· Security risks and incidents must be managed in a way that complements and does not unnecessarily impede agency business operations. By understanding risks and implementing an appropriate level of cost-effective controls, agencies can reduce risk and potential loss significantly.

· A strategy to manage security is essential. Such a strategy should be based on an ongoing cycle of risk management and should be developed in coordination with and implemented by agency program officials. It should identify significant risks, clearly establish responsibility for reducing them, and ensure that risk management remains effective over time.

· Agency program officials must understand the risk to systems under their control and determine the acceptable level of risk, ensure that adequate security is maintained to support and assist the programs under their control, and ensure that security controls comport with program needs and appropriately accommodate operational necessities. In addition, program officials should work in conjunction with Chief Information Officers and other appropriate agency officials so that security measures support agency information architectures.

Policy

Security should be built into and funded as part of the system architecture. Agencies should make security's role explicit in information technology investments and capital programming. These actions are entirely consistent with and build upon the principles outlined in OMB Memorandum 97-02. Accordingly, investments in the development of new or the continued operation of existing information systems, both general support systems and major applications, proposed for funding in the President's budget must:

1. Be tied to the agency's information architecture. Proposals should demonstrate that the security controls for components, applications, and systems are consistent with and an integral part of the information technology architecture of the agency.

2. Be well-planned, by:

a) Demonstrating that the costs of security controls are understood and are explicitly incorporated in the life-cycle planning of the overall system in a manner consistent with OMB guidance for capital programming.

b) Incorporating a security plan that discusses:

· the rules of behavior for the system and the consequences for violating those rules;
· personnel and technical controls for the system;
· methods for identifying, appropriately limiting, and controlling interconnections with other systems and specific ways such limits will be monitored and managed;
· procedures for the on-going training of individuals that are permitted access to the system;
· procedures for the on-going monitoring of the effectiveness of security controls;
· procedures for reporting and sharing with appropriate agency and government authorities indications of attempted and successful intrusions into agency systems;
· provisions for the continuity of support in the event of system disruption or failure.

3. Manage risks, by:

a) Demonstrating specific methods used to ensure that risks and the potential for loss are understood and continually assessed, that steps are taken to maintain risk at an acceptable level, and that procedures are in place to ensure that controls are implemented effectively and remain effective over time.

b) Demonstrating specific methods used to ensure that the security controls are commensurate with the risk and magnitude of harm that may result from the loss, misuse, or unauthorized access to or modification of the system itself or the information it manages.

c) Identifying additional security controls that are necessary to minimize risks to and potential loss from those systems that promote or permit public access, other externally accessible systems, and those systems that are interconnected with systems over which program officials have little or no control.

4. Protect privacy and confidentiality, by:

a) Deploying effective security controls and authentication tools consistent with the protection of privacy, such as public-key based digital signatures, for those systems that promote or permit public access.

b) Ensuring that the handling of personal information is consistent with relevant government-wide and agency policies, such as privacy statements on the agency's web sites.

5. Account for departures from NIST Guidance. For non-national security applications, to ensure the use of risk-based cost-effective security controls, describe each occasion when employing standards and guidance that are more stringent than those promulgated by the National Institute for Standards and Technology.

In general, OMB will consider new or continued funding only for those system investments that satisfy these criteria and will consider funding information technology investments only upon demonstration that existing agency systems meet these criteria. Agencies should begin now to identify any existing systems that do not meet these decision criteria. They should then work with their OMB representatives to arrive at a reasonable process and timetable to bring such systems into compliance. Agencies should begin with externally accessible systems and those interconnected systems that are critical to agency operations. OMB staff are available to work with you if you or your staff have questions or need further assistance in meeting these requirements.