Category: Technology

The Law of the Land for Government Websites

 The following  regulations affect most government Web development efforts.  Individual agencies unique rules and guidance that go above and beyond the items are listed below as well.

• Clinger-Cohen Act of 1996 linked security to agency capital planning and budget processes, established agency chief information officers, and recodified the Computer Security Act of 1987.
• Computer Security Act of 1987, PL 100-235 requires that Federal agencies identify computer systems that contain sensitive information, establish a plan for the security and privacy of these sensitive systems, and provide computer security awareness training. It is designed to improve the security and privacy of sensitive information being maintained in a federally owned or underwritten computer systems.
• Freedom of Information Act, Public Law 90-23 (FOIA)
• General Accounting Office “Federal Information System Control Audit Manual” (FISCAM) provides guidance to auditors in evaluating internal controls over confidentiality, integrity, and availability of data maintained in computer-based information systems.
• National Institute of Standards and Technology (NIST) guidelines provide technical management, physical and administrative standards for cost-effective security, and privacy of sensitive information being stored in federal agency computer systems. OMB (Office of Management and Budget) Circular No. A-130 mandates compliance with appropriate NIST guidelines and standards.
  • NIST Special Publication 800-14, “Generally Accepted Principles and Practices for Security Information Technology Systems,” guides organizations about the types of controls, objectives, and procedures that compromise an effective security program.
  • NIST Special Publication 800-18, “Guide for Developing Security Plans for Information Technology Systems,” details the specific controls that should be documented in a security plan.
  • Federal Information Processing Standards FIPS PUB 102, September 1983, “Guidelines for Computer Security Certification and Accreditation,” is intended to be used to establish and carry out a program and a technical process for computer security certification and accreditation of sensitive computer applications.
• National Plan for Information Systems Protection, Version 1
• OMB Circular No. A-123, revised, “Internal Control Systems,” August 4, 1986 (A-123)
• OMB Circular No. A-127, “Financial Management Systems,” December 19, 1984 (A-127)
• OMB Circular No. A-130, Appendix III, “Security of Federal Automated Systems,” December 12, 1985, revised 1996, requires federal agencies to implement and maintain an automated information security program, including the preparation of policies, procedures, and guidelines. It defines the minimum controls required for general support of systems for major applications.
• Paperwork Reduction Act of 1995 established a comprehensive information resources management framework, including security, and subsumed the security responsibilities of the Computer Security Act of 1987.
• Presidential Decision Directive (PDD) 63 sets a goal of reliable, interconnected, and secure information systems infrastructure and increased security for Federal systems. It addresses all federal infrastructure vulnerabilities, requires each department to work to reduce its exposure to new threats, and specifies agency responsibility for protecting the Nation’s infrastructure.
• PDD 67, “Enduring Constitutional Government and Continuity of Government,” describes continuity of operations (COOP) planning and continuity of government (COG) operations.
• Privacy Act of 1974, Public Law 93-579, 5 USC 522a (1974)
• U.S. Copyright Law Title 17, U.S. Code
• 1996—Information Technology Management Reform Act, established the CIO position to manage the deployment of information technology (IT) resources and requires an agency to justify IT needs.
• 1998—Government paper Elimination Act (http://egov.gov/gpea.htm) becomes effective in October 2003 and calls for the option of electronic maintenance, and submission of forms. So every paper form must have an electronic version too!
• 2000—Federal Rehabilitation Act, Section 508 (http://www.section508.gov), requires all IT products in the federal government to be accessible to people with disabilities.
• 2000—Electronic Signatures in Global and National Commerce Act (http://www.cybersign.com/news_news.htm#June2000esigact) clarifies the legal status of electronic records and signatures in the context of requirements.
• 2001—National Security Telecommunications and Information Systems Security Policy No. 11, effective July 2002, requires that common off-the-shelf software used by defense agencies and organizations to be evaluated and approved by a third party.
• 2001—The Federal Data Quality Act (http://www.whitehouse.gov/omb/fedreg/reproducible.html) went into effect in October 2002.  “The law requires the government to set standards for the quality of scientific information and statistics used and disseminated by federal agencies. It would create a system in every government agency under which anyone could point out errors in documents and regulations . . .  Under the data law, by October every agency must have the equivalent of a complaints line, through which individuals, companies, or groups can challenge scientific findings.”
• eGovernment Act (http://www.egov.gov/2001) promotes electronic services. The act creates the federal CIO position within OMB and requires using the Internet to facilitate access to information.