Which act focuses on government information security and mandates an agency-wide information systems security program?

• A. HIPAA
• B. FERPA
• C. Federal Privacy Act of 1974
• D. Federal Information Security Management Act of 2002 (FISMA)

Answer: (C)

This question tests which federal law requires government agencies to manage information security across all of their information systems. The act that does this mandates an agency-wide information security program, including risk assessments, the implementation of security controls, continuous monitoring, and regular reporting on security posture. It also aligns agencies with standardized controls and practices (often drawn from NIST guidance) to protect federal information assets and ensure accountability across the entire agency.

Other acts address different areas. HIPAA protects the privacy and security of health information in healthcare. FERPA governs access to and disclosure of students’ education records. The Federal Privacy Act of 1974 focuses on privacy rights and the handling of personal information by federal agencies, rather than requiring a comprehensive agency-wide security program.