The act also requires that all operators of federal computer systems , including both federal agencies and their contractors , establish security plans .
Security plans are optional for all organizations that operate any kind of computer system .