david
/
a130


			
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213
							<!DOCTYPE html>
<html>
<head>
  <meta name="google-site-verification" content="xXEGpPeG9CfACp-aeM0kS8pSS9Vk7Z8OS0QB_EehREs" />

  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta charset="utf-8">
  <meta content="width=device-width, initial-scale=1.0" name="viewport">

  <link rel="stylesheet" href="/assets/css/normalize.css">
  <link href="/assets/css/google-fonts.css" rel="stylesheet" type="text/css">
  <link rel="stylesheet" href="/assets/css/styles.css?201509271090037">
  <link rel="stylesheet" href="/assets/css/syntax.css">
  <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
  <script src="/assets/js/jquery.navgoco.min.js"></script>  


  <!--[if lt IE 9]>
    <script src="/assets/js/html5.js"></script>
    <script src="/assets/js/respond.min.js"></script>
  <![endif]-->

  <link rel="shortcut icon" type="image/ico" href="/assets/favicon.ico" />

  <link rel="canonical" href="https://ombegov.github.io/a130//privacy-info-security/" />

  
    <title>Privacy and Information Security</title>
    <meta property="og:title" content="Privacy and Information Security" />
  

    <meta name="description" content="Privacy and Information Security">
    <meta property="og:description" content="Privacy and Information Security" />
  

</head>
<body>

<div class="container">
  <header role="banner">
    <h1>
      <a href="/">OMB Circular A-130</a>
    </h1>
  </header>

  <div class="wrap content">
    <aside>
  <a class="skip-link visuallyhidden focusable" href="#main">Skip to Main Content</a>
  <nav class="sidebar-nav" role="navigation">
    <ul>
      
        
        <li class="">
          <a href="/">Home</a>
        </li>
      
        
        <li class="">
          <a href="/introduction/">Introduction</a>
        </li>
      
        
        <li class="">
          <a href="/purpose/">Purpose</a>
        </li>
      
        
        <li class="">
          <a href="/applicability/">Applicability</a>
        </li>
      
        
        <li class="">
          <a href="/basic_consideration/">Basic Considerations</a>
        </li>
      
        
        <li class="">
          <a href="/policy/">Policy</a>
        </li>
      
        
        <li class="">
          <a href="/gov-wide-responsbilities/">Government-Wide Responsbilities</a>
        </li>
      
        
        <li class="">
          <a href="/effectiveness/">Effectiveness</a>
        </li>
      
        
        <li class="">
          <a href="/oversight/">Oversight</a>
        </li>
      
        
        <li class="">
          <a href="/autorities/">Authorities</a>
        </li>
      
        
        <li class="">
          <a href="/definitions/">Definitions</a>
        </li>
      
        
        <li class="">
          <a href="/inquiries/">Inquiries</a>
        </li>
      
        
        <li class="">
          <a href="/appendix1/">Appendix I</a>
        </li>
      
        
        <li class="">
          <a href="/appendix2/">Appendix II</a>
        </li>
      
        
        <li class="">
          <a href="/appendix3/">Appendix III</a>
        </li>
      
    </ul>
  </nav>
  <p>
    <a href="https://github.com/OMBEGOV/a130/edit/gh-pages/pages/privacy-info-security.md">Edit this page</a>
  </p>
</aside>


    <article id="main" class="main-content" role="main">
      <h1>Privacy and Information Security</h1>

<h3 id="privacy-and-information-security"><strong>Privacy and Information Security</strong></h3>

<p>Although this section includes requirements for protecting Federal information resources, this area is covered more fully in the Appendices to this Circular.</p>

<ol>
<li>Privacy</li>
</ol>

<p>To ensure proper safeguards, agencies shall:</p>

<ol>
<li>Designate a senior agency official for privacy (SAOP) who has overall agency-wide responsibility and accountability for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws, regulations, and policies regarding the collection, use maintenance, dissemination, and disposal of PII by programs and information systems;</li>
<li>Limit the collection of information such as personally identifiable information, to that which is legally authorized and necessary for the proper performance of agency functions;</li>
<li>Only maintain personally identifiable information that is relevant and necessary to accomplish a legally authorized purpose;</li>
<li>Limit the disclosure of personally identifiable information or proprietary information to that which is legally authorized, and impose appropriate conditions on use where a continuing obligation to ensure the confidentiality of the information exists;</li>
<li>Provide individuals, upon request, access to records about them maintained in Privacy Act systems of records, and permit them to amend such records consistent with the provisions of the Privacy Act;</li>
<li>Comply with all applicable requirements of the Privacy Act and ensure that system of records notices are published, revised, and rescinded, as required;</li>
<li>Ensure that all records with personally identifiable information are maintained in accordance with applicable records retention or disposition schedules approved by the National Archives and Records Administration;</li>
<li>Conduct privacy impact assessments when developing, procuring, or using information technology, in accordance with the E-Government Act, and make the assessments available to the public in accordance with OMB policy; and</li>
<li><p>Maintain and post privacy policies on all agency websites, in accordance with OMB policy.</p></li>
<li><p>Information Security</p></li>
</ol>

<p>To ensure proper safeguards, agencies shall:</p>

<ol>
<li>Ensure the CIO designates a senior agency information security officer to develop and maintain an agency-wide information security program in accordance with the Federal Information Security Modernization Act of 2014;</li>
<li>Ensure that information is protected commensurate with the risk that would result from unauthorized access, use, disclosure, disruption, modification, or destruction of such information;</li>
<li>Implement security policies issued by the Office of Management and Budget (OMB), and related government-wide requirements and procedures issued by the Department of Commerce, Department of Homeland Security, General Services Administration, and the Office of Personnel Management. This includes applying the standards and guidelines contained in the National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS), NIST Special Publications (SPs) (e.g., 800 series guidelines), and where appropriate and directed by OMB, NIST Interagency or Internal Reports (NISTIRs).</li>
</ol>


    </article>

  </div>
</div>

<!-- <script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-48605964-20', 'auto');

  // anonymize user IPs (chops off the last IP triplet)
  ga('set', 'anonymizeIp', true);

  // forces SSL even if the page were somehow loaded over http://
  ga('set', 'forceSSL', true);

  ga('send', 'pageview');
</script>
<!-- Digital Analytics Program roll-up, see https://analytics.usa.gov for data
<script async id="_fed_an_ua_tag" src="/assets/js/Universal-Federated-Analytics-Min.js?agency=GSA"></script> --> -->


</body>
</html>