Which act requires federal agencies to develop, document, and implement an agency-wide information security program?

Which act requires federal agencies to develop, document, and implement an agency-wide information security program?

• A. Federal Privacy Act of 1974
• B. Gramm-Leach-Bliley Act (GLBA)
• C. Family Educational Rights and Privacy Act (FERPA)
• D. Federal Information Security Management Act of 2002 (FISMA)

Answer: (D)

A formal, agency‑wide approach to protecting information systems is required by this law. It mandates that federal agencies develop, document, and implement an agency‑wide information security program, covering risk management, security controls, assessments, authorization, continuous monitoring, and reporting. The requirement is tied to using established standards from NIST and conducting regular reviews to keep security up to date across the entire agency. The other acts focus on privacy protections rather than mandating a comprehensive security program for federal agencies. The Federal Privacy Act of 1974 deals with records privacy; the Gramm‑Leach‑Bliley Act addresses safeguarding consumer financial information in the private sector; FERPA protects the privacy of student education records. While they establish important privacy rules, they do not establish the agency‑wide information security program mandate. Therefore, the act that requires federal agencies to develop, document, and implement an agency‑wide information security program is the Federal Information Security Management Act of 2002.

A formal, agency‑wide approach to protecting information systems is required by this law. It mandates that federal agencies develop, document, and implement an agency‑wide information security program, covering risk management, security controls, assessments, authorization, continuous monitoring, and reporting. The requirement is tied to using established standards from NIST and conducting regular reviews to keep security up to date across the entire agency.

The other acts focus on privacy protections rather than mandating a comprehensive security program for federal agencies. The Federal Privacy Act of 1974 deals with records privacy; the Gramm‑Leach‑Bliley Act addresses safeguarding consumer financial information in the private sector; FERPA protects the privacy of student education records. While they establish important privacy rules, they do not establish the agency‑wide information security program mandate.

Therefore, the act that requires federal agencies to develop, document, and implement an agency‑wide information security program is the Federal Information Security Management Act of 2002.