FISMA

What is FISMA?

FISMA is the US law that sets how federal agencies must protect their information and information systems. The current version, the Federal Information Security Modernization Act of 2014, amended the Federal Information Security Management Act of 2002; both are known as FISMA. It is codified at 44 U.S.C. 3551 and following.

The law itself is short on technical detail. It assigns responsibilities and points to standards, and most of the practical requirements come from NIST and from guidance issued each year by OMB and CISA.

Who does it apply to?

FISMA applies to federal executive branch agencies. Each agency must protect “information systems used or operated by an agency or by a contractor of an agency”, in the words of 44 U.S.C. 3554. That is why contractors meet FISMA through their contracts: a company that runs a system for an agency, or holds agency data, is expected to meet the same standards. Cloud services reach agencies through FedRAMP, which applies FISMA’s standards to cloud.

National security systems follow a separate track and are mostly outside the civilian rules described here.

Who does what?

• OMB oversees agencies’ security practices and sets policy, such as its Circular A-130 on managing federal information.
• CISA, part of the Department of Homeland Security, runs day-to-day oversight for civilian systems. It issues binding operational directives that agencies must follow, such as the deadlines in its Known Exploited Vulnerabilities catalog, and houses the federal incident centre.
• NIST writes the standards and guidelines agencies must use.
• Agency heads are accountable for their agency’s security. Chief information officers and chief information security officers run the programme, and each agency’s Inspector General evaluates it independently every year.

What does compliance involve?

Agencies follow NIST’s Risk Management Framework (SP 800-37). They categorise each system by impact using FIPS 199, apply minimum requirements from FIPS 200 using controls from SP 800-53, and assess the controls. A senior official then formally accepts the remaining risk by granting an authorisation to operate, and the controls are monitored continuously after that.

What is reported?

Each year agencies report on the adequacy and effectiveness of their security programmes to OMB, DHS, Congress and the Government Accountability Office, including their major incidents and breaches of personal information. Major incidents must also be reported to Congress as they happen. CISA publishes the metrics agencies report against for each fiscal year: CIO metrics, privacy metrics and an evaluation guide for Inspectors General.

Why does it matter outside government?

FISMA is the reason federal contracts carry security clauses, and the source of the NIST standards that many private organisations adopt voluntarily. If you supply federal agencies, expect to show controls drawn from SP 800-53 and to report incidents quickly under your contract.