access federal information system must:
- defined security & privacy req
- use state art equipment & aquisition processes
- security & privacy planning
- system development life cycle management
- engineer for security & privacy
- document practices & processes
- continously monitor