The act also requires that all operators of federal computer systems, including both federal agencies and their contractors, establish security plans.
These security plans are normally drafted by executives with very little computer knowledge.