OMB A-130

Office of Management and Budget (2016) Managing Information as a Strategic Resource. (The White House, Washington, DC), OMB Circular A130, July 2016.

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a13 0revised.pdf

Executive Summary

OMB Circular A-130 establishes government-wide policy for the planning, budgeting, governance, acquisition, and management of Federal information and information technology (IT) resources. It provides the foundational framework for agencies to manage information as a strategic asset — integrating privacy, cybersecurity, records management, open data, and digital service delivery.

It applies to all executive agencies and covers both electronic and paper information.

It aligns with laws such as:

• Clinger-Cohen Act (IT Management Reform Act)
• E-Government Act of 2002
• Federal Information Security Modernization Act (FISMA)
• Federal Information Technology Acquisition Reform Act (FITARA)
• Paperwork Reduction Act (PRA)
• Privacy Act of 1974

1. Purpose and Core Principles

• Federal information and IT are strategic national resources critical for public service delivery, transparency, and innovation.
• Policies ensure information quality, security, privacy, and efficient resource use.
• Information should be:

• • Accessible and interoperable (open data, transparency)
  • Secure and privacy-protective
  • Cost-effective and performance-driven
  • Governed throughout its lifecycle (creation → use → disposition)

2. Major Policy Areas

a. Planning & Budgeting

• Each agency must maintain an Information Resource Management (IRM) Strategic Plan linked to its mission and performance goals.
• Maintain inventories of information systems and personally identifiable information (PII).
• Perform continuous risk management using NIST standards.
• Develop Enterprise Architectures (EA) aligned with strategic goals.
• Include CIO, CFO, and CAO in IT budgeting per FITARA.
• Develop Business Continuity Plans ensuring mission continuity during disruptions.

b. Governance

• CIOs must establish governance structures ensuring:

• • Integration of IT, data, and security across the enterprise.
  • Evaluation of IT investments (cost, schedule, performance).
  • Adoption of open data standards and agile development.
  • Phasing out unsupported systems.

• TechStat reviews and other performance metrics are required to assess IT portfolio health.

c. Leadership & Workforce

• Agencies must plan workforce competencies for IT, cybersecurity, and privacy roles.
• CIO and CHCO must establish performance elements for IT leadership.
• The Senior Agency Official for Privacy (SAOP) and Senior Agency Official for Records Management (SAORM) have defined responsibilities.
• Agencies must leverage flexible hiring authorities for specialized technical roles.

d. IT Investment Management

• Agencies must ensure competition, risk analysis (including supply chain), and life-cycle cost assessment in IT acquisitions.
• Prefer shared services and modular contracts.
• CIO approval required for all IT acquisitions.
• Apply Earned Value Management (EVM) and baseline validation.
• Design systems for interoperability, accessibility (Section 508), records retention, and security.

e. Information Management & Access

• Federal data should be discoverable, accessible, and reusable unless restricted.
• Publish information online in machine-readable formats (open data).
• Avoid exclusive distribution contracts or paywalls.
• Collect information electronically using open standards and metadata.
• Maintain feedback mechanisms and ensure data governance policies.
• Agencies must balance privacy, confidentiality, and transparency.

f. Privacy & Information Security

• Establish a comprehensive privacy program led by a Senior Agency Official for Privacy (SAOP).
• Conduct Privacy Impact Assessments (PIAs) for new or modified systems.
• Protect PII throughout its lifecycle; minimize unnecessary collection (e.g., Social Security Numbers).
• Implement agency-wide information security programs per FISMA and NIST standards.
• Adopt risk-based, integrated security and privacy management.

g. Electronic Signatures

• Promote legally recognized electronic and digital signatures.
• Enable electronic transactions and recordkeeping consistent with GPEA and E-SIGN Act.

h. Records Management

• Agencies must:

• • Appoint a SAORM.
  • Manage records electronically.
  • Retain email and other digital records per NARA guidelines.
  • Ensure timely disposition and employee training.

i. Leveraging the Internet (IPv6)

• Agencies must adopt the latest Internet Protocol (IPv6) and ensure public-facing systems support it.

3. Government-Wide Responsibilities

Outlined for:

• Department of Commerce (NIST, NTIA): develops standards and cybersecurity frameworks.
• Department of Homeland Security (DHS): issues binding operational directives and oversees FISMA implementation.
• Federal CIO Council: coordinates IT management policy and cross-agency initiatives.
• Federal Privacy Council: coordinates government privacy policy.
• GSA: manages shared IT contracts and Federal PKI framework.
• NARA: oversees records management and Controlled Unclassified Information (CUI).
• OPM: manages IT and privacy workforce development.

4. Oversight & Authority

• OMB oversees compliance through budget and IT reviews.
• Agencies may request waivers, but must publish notice and transition to full compliance.
• Circular derives authority from statutes such as FITARA, FISMA, PRA, and E-Government Act.

5. Appendices Overview

Appendix I – Protecting and Managing Federal Information Resources

• Sets minimum security and privacy program requirements.
• Requires risk management frameworks (NIST SP 800-37) and continuous monitoring.
• Defines roles for CIO, SAOP, and Authorizing Officials.
• Mandates:

• • Incident response and reporting (to DHS, OMB, etc.).
  • Contingency and business continuity planning.
  • Mandatory training and least-privilege access.
  • Oversight of contractor systems and supply chain risk.
  • Use of encryption (FIPS 140-validated).
  • Ongoing authorization (continuous ATO).

Appendix II – Managing Personally Identifiable Information (PII)

• Outlines the Fair Information Practice Principles (FIPPs):

• • Access, Accountability, Authority, Minimization, Quality, Participation, Purpose Limitation, Security, Transparency.

• Defines SAOP’s responsibilities and required privacy program structure.
• Requires:

• • Inventories of PII systems.
  • PIAs for all IT involving PII.
  • Privacy continuous monitoring programs.
  • Privacy training, accountability, and incident response.

• Adds requirements for PII collected under a pledge of confidentiality (CIPSEA).

6. Key Takeaways

• Integrated governance: Privacy, security, records, and data management are unified.
• Accountability: CIOs, SAOPs, and SAORMs are responsible for compliance and reporting.
• Lifecycle focus: Every stage of data and system management must include risk and privacy considerations.
• Transparency and trust: Citizens’ access, rights, and privacy are central to all Federal information management activities.