Center for Federal Accountability

Requirements

The requirements CFA tests every federal agency against, each with its legal authority and the public or FOIA evidence that shows whether it is met.

94 requirements in 20 themes, catalog version 0.5.0. No agency has been graded on them yet.

Cybersecurity Governance

• IG's FISMA effectiveness conclusion and maturity level, recorded separately (KAI-GOV-IGR)
• IG FISMA evaluation exists and the agency appears in OMB's FISMA report to Congress (KAI-GOV-RPT)
• A senior information security officer is designated (KAI-GOV-SAI)
• Zero trust progress as rated in the IG's supplemental metric (KAI-GOV-ZTA)
• Post-quantum migration plan sent to OMB and ONCD on time (KAI-GOV-PQC)

Supply Chain Risk

• No direct purchases from legally barred sources (Kaspersky, named telecom firms, FASCSA orders that bind the agency) (KAI-SCR-PRH)
• No covered foreign drones bought or operated (KAI-SCR-DRN)
• Waivers for non-compliant connected devices are reported (KAI-SCR-IOT)

Risk and Asset Management

• Reported system inventory is consistent with other public records (KAI-RAM-INV)
• Systems operate with a current authorization (KAI-RAM-ATO)
• High value asset protections, as found by IG and GAO audits (KAI-RAM-HVA)
• Cloud services in use are FedRAMP authorized (KAI-RAM-CLD)
• Agency cloud authorization policy issued and sent to OMB (KAI-RAM-FRP)
• Agency authorizations of FedRAMP cloud services are reported to FedRAMP (KAI-RAM-ATR)
• Asset discovery and scanning on the required cadence (KAI-RAM-AST)

Configuration Management

• Known exploited vulnerabilities fixed within the required windows (KAI-CFG-VUL)
• Secure cloud configuration baselines applied (KAI-CFG-SCB)
• Baseline configurations documented and enforced (KAI-CFG-BAS)

Identity and Access

• Phishing-resistant multifactor authentication for staff (KAI-IAM-MFA)
• Staff and contractors use PIV credentials (KAI-IAM-PIV)
• Public sign-in uses Login.gov (on schedule until the deadline) (KAI-IAM-PUB)
• Privileged access limited and reviewed (KAI-IAM-PRV)

Data Protection

• Data encrypted at rest and in transit with validated modules (KAI-DPP-ENC)
• CUI program in place and reported to ISOO each year (KAI-DPP-CUI)
• Breach response plan exists and is tested (KAI-DPP-BRE)

Security Training

• All users trained each year (KAI-TRN-AWR)
• Staff with security duties get role-based training (KAI-TRN-RBT)

Continuous Monitoring

• Logging maturity meets the current memo (KAI-MON-LOG)
• Endpoint detection deployed with CISA access (KAI-MON-EDR)
• Continuous monitoring program (KAI-MON-ISC)

Incident Response

• Incidents reported to CISA and counted in OMB's report (KAI-INR-RPT)
• Publicly known major incidents were reported to Congress (KAI-INR-MAJ)
• Emergency directive actions completed on time (KAI-INR-EMD)

Contingency Planning

• Contingency plans tested (KAI-RPL-TST)

Public Exposure

• Email domains reject spoofed mail; non-mail domains publish a null policy (KAI-EXP-EML)
• Public websites redirect to HTTPS and send HSTS (KAI-EXP-WEB)
• Agency domains are signed with DNSSEC (SHOULD; the 2008 memo was rescinded in 2018) (KAI-EXP-DNS)
• Vulnerability disclosure policy published, scoped to all domains, with a registered security contact (KAI-EXP-VDP)
• Edge devices and management interfaces secured, as found by IG and GAO (KAI-EXP-EDG)
• Official websites and email use .gov domains (KAI-EXP-GOV)
• Public websites reachable over IPv6 (KAI-EXP-IP6)
• Public websites negotiate TLS 1.3 (trend only before the 2030 deadline) (KAI-EXP-TLS)
• Third-party trackers and assets match what the privacy policy discloses (KAI-EXP-3PT)

Privacy and Information Collection

• SORNs and PIAs describe the same records, and SORNs are reviewed (KAI-PRV-SRN)
• New and changed SORNs allow 30 days for comment before taking effect (KAI-PRV-SRC)
• A PIA exists for each system with a SORN (KAI-PRV-PIA)
• Every Privacy Act exemption claimed has a final rule (KAI-PRV-EXR)
• Matching programs have published notices, or the agency states it has none (KAI-PRV-CMA)
• Senior privacy official designated; privacy program page live (KAI-PRV-SAO)
• Website privacy policies contain the required elements (KAI-PRV-WEB)
• Privacy Act requests and consent accepted electronically (KAI-PRV-EPA)
• No information collections running on expired OMB approvals (KAI-PRV-ICR)
• Sampled public forms display a valid OMB control number (KAI-PRV-FRM)

Financial System Controls

• Auditor reports no IT material weakness; significant deficiencies tracked separately (KAI-FIN-AUD)
• Auditor finds substantial compliance with FFMIA (KAI-FIN-FFM)
• The agency head's assurance statement matches the auditor's IT findings (KAI-FIN-SOA)
• IG finds the agency compliant with the payment integrity law (KAI-FIN-PII)
• Spending data submitted on time; IG rates its quality (KAI-FIN-DAT)

IT Management and Acquisition

• CIO reports to the agency head and approves IT contracts (KAI-ITM-CIO)
• Software license inventory maintained and used (KAI-ITM-MBY)
• Custom source code inventory published (KAI-ITM-SRC)

AI Governance

• AI use-case inventory published at the agency's /ai page (KAI-AIG-INV)
• Chief AI Officer named; compliance plan and strategy published where required (KAI-AIG-CMP)
• High-impact AI waivers and practice summaries published (KAI-AIG-WVR)
• AI contracts protect government data from vendor training use (KAI-AIG-ACQ)

Digital Public Experience

• Public websites are accessible, searchable, mobile-friendly and use the federal design system (KAI-DIG-IDA)
• The main website shows required links (about, FOIA, accessibility, privacy, disclosure policy, No FEAR) (KAI-DIG-REQ)
• Public websites run the federal Digital Analytics Program (KAI-DIG-DAP)
• Public content is open to search engines and archives (KAI-DIG-CRW)
• Section 508 program maturity and website conformance (KAI-DIG-508)
• Forms and services offered digitally (KAI-DIG-ELC)
• Covered services connected to America.gov (not yet due) (KAI-DIG-AGV)
• Plain writing compliance report posted (KAI-DIG-PLW)

Transparency and FOIA

• FOIA annual report filed on time with complete data (KAI-TRP-FAR)
• FOIA backlog and processing times improving (excluding CFA's own requests) (KAI-TRP-BKL)
• Chief FOIA Officer report published (KAI-TRP-CFR)
• FOIA reading room posts frequently requested records (KAI-TRP-RRM)
• FOIA regulations updated for the 2016 amendments (KAI-TRP-REG)
• Open government page maintained (KAI-TRP-OPN)
• Data inventory and open data plan published (KAI-TRP-ODP)
• Chief Data Officer, learning agenda and evaluation plan posted (KAI-TRP-EVA)
• Strategic plan and annual performance plan and report posted (KAI-TRP-PRF)

Federal Records

• Senior records official's annual report filed with NARA (KAI-REC-SAO)
• Permanent records and email managed electronically (KAI-REC-ELR)
• Records schedules approved, including email (KAI-REC-SCH)
• Unauthorized destruction cases reported to NARA and closed (KAI-REC-UDR)
• Official business on personal messaging accounts is copied to official records (KAI-REC-MSG)

Oversight Responsiveness

• IG open recommendations on IT and security closed by agreed dates (KAI-OVR-IGO)
• GAO priority recommendations implemented (KAI-OVR-GAO)

Legal Authority

• Each system of records notice cites a legal authority that is in force (KAI-AUT-SRN)
• Each information collection cites the legal authority for collecting it (KAI-AUT-ICR)
• Proposed rules state the legal authority they rest on (KAI-AUT-NPR)
• Assistance programs name their authorizing law, and awards fit the program (KAI-AUT-ALN)
• Annual performance report says which goals were met and explains each one missed (KAI-AUT-PRF)