agencies. At the agency level, IT management must be integrated into procurement, and procurement of commercial-off-the-shelf technology was encouraged. CCA required each agency to name a Chief Information Officer (CIO) with the responsibility of "developing, maintaining, and facilitating the implementation of a sound and integrated information technology architecture". The CIO is tasked with advising the agency director and senior staff on all IT issues. Since these rules went into effect, the agency CIOs also have worked together to form the US Federal CIO Council. Initially an informal group, the council's existence became codified into law by Congress in the E-Government Act of 2002. Official duties for the council include developing recommendations for government information technology management policies, procedures, and standards; identifying opportunities to share information resources; and assessing and addressing the needs of the Federal Government's IT workforce. In general, National Security Systems (NSS), as defined in 40 USC 11103, are exempt from the Act. However, there are specific exceptions to this exemption regarding: Capital Planning and Investment Control (CPIC); Performance- And Results-Based Management; Agency Chief Information Officer (CIO) responsibilities; and Accountability. Raines' Rules Following the Clinger–Cohen Act, White House budget director Franklin Raines issued a supplementary policy memorandum, M-97-02, in 1996 that became known as "Raines' Rules". The memorandum specified the following eight investment criteria for new IT projects: support core/priority mission functions that need to be performed by the Federal government; be undertaken by the requesting agency because no alternative private sector or governmental source can efficiently support the function; support work processes that have been simplified or otherwise redesigned to reduce costs, improve effectiveness, and make maximum use of commercial, off-the-shelf technology; demonstrate a projected return on the investment that is clearly equal to or better than alternative uses of available public resources. Return may include: improved mission performance in accordance with GPRA measures; reduced cost; increased quality, speed, or flexibility; and increased customer and employee satisfaction. Return should be adjusted for such risk factors as the project's technical complexity, the agency's management capacity, the likelihood of cost overruns, and the consequences of under- or non-performance be consistent with Federal, agency, and bureau information architectures which: integrate agency work processes and information flows with technology to achieve the agency's strategic goals; reflect the agency's technology vision and year 2000 compliance plan; and specify standards that enable information exchange and resource sharing, while retaining flexibility in the choice