In $2002,$ Congress passed the Federal Information Security Management Act $($FISMA$),$ which mandates that all federal agencies

provide security awareness training

periodic assessment of risk

develop policies and procedures based on risk assessments

all of the other answers are correct