Which circular imposes new privacy and security requirements and a structure for authority to operate for federal IT systems?

• A. OMB Circular A-130 Appendix III
• B. OMB Circular A-123
• C. OMB Circular A-94
• D. OMB Circular A-102

Answer: (A)

The question tests knowledge of which OMB policy piece specifically sets privacy and security requirements for federal IT and establishes the formal authorization-to-operate framework for systems. The correct circular is the one that internalizes privacy protections and security controls across federal information resources and nails down how an information system gets approved to operate within an agency. This circular codifies the responsibilities and processes that agencies use to ensure systems meet privacy and security standards before they can run, aligning with risk management and FISMA/NIST guidance. That’s why it’s the best fit for introducing both new privacy/security requirements and the authority-to-operate structure.

The other circulars focus on different areas: one is about internal controls over financial management, another covers cost-effectiveness analysis and program evaluation guidelines, and the last deals with grants and cooperative agreements with state and local governments. They don’t establish IT privacy/security requirements or the authorization-to-operate framework for federal systems.