Hardware, software, operators, and users are addressed. The policies limit manipulation of the data to authorized agency terminals and limit disclosure of information from the system through terminals to authorized final users. They state that information in the system must be protected against unauthorized access in the computer center, unauthorized alteration, loss, and unauthorized use. The final policy statement maintains that system security is a line responsibility equal in importance to system performance. Each policy statement is followed by procedures that illustrate the types of activities which States would undertake in implementing the policy.