In 2002, Congress passed the Federal Information Security Management Act (FISMA), which mandates that all federal agencies provide security awareness training, periodic assessment of risk, and develop policies and procedures based on risk assessments. All of the other answers are correct.