This chapter reviews the laws that protect the security and privacy of data that the federal government uses. FISMA, the main law protecting the security of federal government IT systems, requires federal agencies to create information security programs. Agencies also must review their information security risks. The law requires them to implement controls to mitigate those risks.

The Privacy Act of 1974 and the E-Government Act of 2002 are the main laws protecting data privacy at the federal level. These laws govern how federal agencies use personally identifiable data. Under the E-Government Act, federal agencies must review their IT systems for any privacy impacts. Both laws require federal agencies to notify the public about their data collection practices.