The act also requires that all operators of federal computer systems, including both federal agencies and their contractors, establish security plans.
Security plans are required for all organizations that operate federal computer systems.