M-00-13 covers privacy policies and data collection on Federal Web Sites. It requires agencies to do which of the following?

• A. Post clear privacy policies
• B. Encrypt all data at rest
• C. Publish annual security reports
• D. Retain logs for two years

Answer: (A)

M-00-13 focuses on privacy notices for federal web sites and requires agencies to provide transparency about data collection by posting clear privacy policies. This ensures visitors know what data is collected, how it will be used, with whom it might be shared, and how it’s protected. The emphasis is on informing users, not on implementing specific technical controls or reporting beyond the privacy notice itself. Encrypting all data at rest, publishing annual security reports, or retaining logs for a set period are important security or governance activities, but they are not the privacy-notice requirement highlighted by this memorandum.