Enacted by Congress in 2002, it mandates that all federal agencies establish information security programs to protect their information assets Effectively brought the federal government in line with the private sector.