The Security Act requires the establishment of agencywide information security programs , annual agency program reviews , annual independent evaluations of agency programs and practices , agency reporting to OMB , and OMB reporting to Congress .
The Security Act requires that the agency has a security program .