OMB Flashcards
M-96-20
Implementation of the Information Technology Management Reform Act of 1996
M-97-02
Funding Information Systems Investments
M-97-16
Information Technology Architecture
M-09-32
Update on the Trusted Internet Connections Initiative
- Inventory external connections
- Required agencies to submit POAM for meeting TIC requirements
M-09-02
Information Technology Management Structure and Governance Framework
-Heads of agencies to consult with the Director of the OMB prior to appointing a CIO, and to advise the Director on matters regarding the authority, responsibilities and organizational resources of the CIO, per OMB Circular A-130
M-08-27
Guidance for Trusted Internet Connection (TIC) Compliance
M-08-23
Securing the Federal Government’s Domain Name System Infrastructure
M-08-22
Guidance on the Federal Desktop Core Configuration (FDCC)
-Agencies will use SCAP tools to scan for both FDCC configurations and configuration deviations approved by the AO
M-08-16
Guidance for Trusted Internet Connection Statement of Capability Form (SOC)
M-08-05
Implementation of Trusted Internet Connections (TIC)
M-08-01
HSPD-12 Implementation Status
M-07-18
Ensuring New Acquisitions Include Common Security Configurations
-Provides recommended language to ensure new acquisitions include common security configurations and vendors certify their products operate effectively using these configurations
M-07-16
Safeguarding Against and Responding to the Breach of Personally Identifiable Information
- Safeguarding PII
- Breach notification policy
- SAOP reporting metrics
- Requires agency-based incident reporting policy
M-07-11
Implementation of Commonly Accepted Security Configurations for Windows Operating Systems
M-07-06
Validating and Monitoring Agency Issuance of Personal Identity Verification Credentials
-Ensure agency credentials meet FIPS 201 requirements
M-06-19
Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments
-Requires reporting of potential PII data breach events to CERT within 1 hour of discovery
M-06-18
Acquisition of Products and Services for Implementation of HSPD-12
M-06-16
Protection of Sensitive Agency Information
M-06-15
Safeguarding Personally Identifiable Information
-Requires privacy policies and public release of policies
M-06-06
Sample Privacy Documents for Agency Implementation of Homeland Security Presidential
Directive (HSPD) 12
M-05-24
Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors
M-05-08
Designation of Senior Agency Officials for Privacy
M-04-16
Software Acquisition
M-04-15
Development of Homeland Security Presidential Directive (HSPD) - 7 Critical Infrastructure Protection Plans to Protect Federal Critical Infrastructures and Key Resources
M-04-04
E-Authentication Guidance for Federal Agencies
- Requires eRA for all electronic transactions
- Defines criteria for access to Federal services online
M-03-22
OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002
-Provides PIA guidance and requirements for all federal agencies
M-03-18
Implementation Guidance for the E-Government Act of 2002
M-02-09
Reporting Instructions for the Government Information Security Reform Act and Updated Guidance on Security Plans of Action and Milestones
M-02-09
Guidance for Preparing and Submitting Security Plans of Action and Milestones
M-01-05
Guidance on Inter-Agency Sharing of Personal Data - Protecting Personal Privacy
M-00-13
Privacy Policies and Data Collection on Federal Web Sites
M-99-18
Privacy Policies on Federal Web Sites
M-10-28
Clarifying Cybersecurity Responsibilities and Activities of the Executive Office of the President and DHS
- Set OMB as reporting agency and DHS and Gathering agency for cybersecurity data and events
- Updated by FISMA 2014
M-14-03
Enhancing the Security of Federal Information and Information Systems
-Established continuous monitoring under DHS control
M-14-04
Fiscal Year 2013 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management
- Made 800-53 privacy controls mandatory
- SAOP approval required for ATO