OMB has provided guidance since 1985 in its Circular A130, Appendix III, Security of Federal Automated Information Resources, which was updated in February 1996.
The Circular was widely regarded as one of the finest pieces of literature produced by the OMB that year.