The Security Act requires the establishment of agencywide information security programs, annual agency program reviews, annual independent evaluations of agency programs and practices, agency reporting to OMB, and OMB reporting to Congress.
The Security Act requires that the agency has a security program.