The act also requires that all operators of federal computer systems, including both federal agencies and their contractors, establish security plans.
Security plans are optional for all organizations that operate any kind of computer system.