Which of the following US Acts emphasized a "risk-based policy for cost-effective security" and makes mandatory for agency program officials, chief information officers, and inspectors general (IGs) t

The Federal Information Security Management Act (FISMA) of 2002 established a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. It specifically requires federal agencies to develop, document, and implement an agency-wide information security program, including annual reviews and reporting to the Office of Management and Budget (OMB), emphasizing a risk-based policy.

The Electronic Communications Privacy Act (ECPA) primarily addresses the privacy of electronic communications, not federal information security program management and reporting.

The Equal Credit Opportunity Act (ECOA) prohibits discrimination in credit transactions, which is unrelated to federal information security.

The Fair Credit Reporting Act (FCRA) regulates the collection, dissemination, and use of consumer credit information, not federal agency information security programs.