FISMA Compliance History & Requirements

FISMA is necessary for federal agencies but may also affect the compliance standards required by your business if you do work for a federal agency.

What does FISMA stand for? FISMA stands for the Federal Information Security Management Act, which was passed by Congress in 2002 and amended in 2014. This act requires federal agencies to meet certain security standards to protect citizens’ private data.

What Is FISMA?

In 2002, Congress passed the E-Government Act, a broad and far-reaching law, to improve how government agencies handle, store, and transmit their information in a digital age. Specifically, the law focused on promoting electronic management of government information, using the internet to open avenues for citizen participation, and improving how these agencies can use digital technology to collaborate with other agencies.

Perhaps the most important part of this law (or, at least, the best-known portion) is the Federal Information Security Management Act (FISMA). Under FISMA, federal agencies are required to “develop, document, and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other sources.”

This definition may seem a bit broad—and it is. But its importance rests in the fact that it was the first federal law to expressly state that agencies were not only expected to leverage digital technology as part of their operation, but that they also had to comply with rather strict standards to build their own information security systems and implement security measures to protect sensitive data.

The original law, passed in 2002, implemented oversight of official federal efforts to modernize IT. Jurisdiction over technical infrastructure was placed squarely under the Office of Management and Budget (OMB). Under FISMA, cybersecurity regulations are set by the National Institute of Standards and Technology (NIST), which publishes specifications and updates that guide government agencies and contractors. These specifications inform wide-ranging security frameworks like FedRAMP, CMMC, and the Risk Management Framework.

In 2014, Congress amended the act to modernize it in light of more advanced threats and technologies. The 2014 update added a few new guidelines:

• Codifying the role of the Department of Homeland Security in governing security policies for nonnational security federal Executive Branch systems
• Clarifying the authority of the OMB with regards to oversight of federal security agencies and their IT security practices
• Changes to a section in the law regarding inefficient reporting

What Is FISMA Compliance?

There are some specific steps that an organization can take to meet FISMA compliance:

• Use Controls Listed in National Institute of Standards and Technology Special Publications: FISMA assumes the implementation of security controls within an agency’s infrastructure or that of partner contractors. Key documents include NIST SP 800-53 (security controls for federal agencies), NIST SP 800-171 (protecting Controlled Unclassified Information), NIST SP 800-37 (the Risk Management Framework), FIPS 199 (standards for categorizing federal systems), and FIPS 200 (minimum security requirements for federal systems).
• Inventory IT Systems: The core of FISMA compliance is creating a catalog of all IT systems used by an agency or contractor. This includes integrated technology and vendor technology.
• Categorizing Risk for Systems: Following FIPS 199, agencies and businesses are expected to categorize their systems along with FIPS 199 categories, which rank system security requirements based on a scale of low, moderate, and high impact. Each level will typically carry different requirements for the agency.
• Creating a System Security Plan: A security plan is a comprehensive plan in place to map out security controls and approaches for maintenance, upgrades, and assessments. Frameworks like CMMC and FedRAMP include a security plan requirement to meet FISMA regulations.
• Certification and Accreditation: Pursue FISMA compliance through an accreditation process managed by the OMB. The OMB requires new certification assessments every three years.

Alongside these requirements, NIST suggests that organizations pursuing compliance follow the seven-step process outlined under the Risk Management Framework. These steps are as follows:

• Prepare for risk management by aligning organizational resources and priorities around assessing and documenting risk, preparing risk management plans, and designing a risk management program.
• Categorize all IT systems in the organization along categories defined in FIPS 199 (low, moderate, and high).
• Select necessary controls from NIST 800-53 based on risk assessments (including any controls required beyond FISMA compliance).
• Implement those controls and document implementation for future monitoring and optimization.
• Assess controls and implementation to determine proper functionality and measure outcomes and results of such implementation.
• Authorize system operation through senior-level executives and IT managers who understand the organization’s risk profile and cybersecurity posture.
• Continuously monitor all controls for changes to operation or risk or in preparation for upgrades.

Benefits of Being FISMA Compliant

FISMA compliance is a must-have for government agencies, and the benefits of being FISMA compliant are plentiful. By implementing and maintaining the security controls recommended by FISMA, organizations are able to protect their information systems and the data stored on them from unauthorized access, modification, or destruction.

With proper security measures in place, FISMA-compliant organizations can have greater confidence that their data is secure, allowing them to focus on their core operations and mission instead of worrying about security. FISMA helps make organizations more efficient by streamlining the security process, providing more structured and repeatable processes, and more consistent security controls across systems. Finally, the compliance process itself is relatively straightforward and cost-effective, meaning organizations can often quickly and easily become compliant with FISMA.

What Are the Differences Between FISMA and FedRAMP?

The Federal Risk and Authorization Management Program (FedRAMP) is a federal cybersecurity compliance framework targeting cloud service providers offering products or services to government agencies.

Much like FISMA, FedRAMP  relies on NIST 800-53 to define security controls necessary for compliance. It also leverages FIPS 199 and FIPS 200 to define security levels and appropriate security technologies like encryption and cryptography. FedRAMP is sometimes referred to as “FISMA for the cloud.”

However, FedRAMP introduces several different requirements above and beyond FISMA, including the following:

• Agency Sponsorship: At its core, FedRAMP applies FISMA-like compliance standards to cloud providers (vendors) working with agencies rather than the agencies themselves. As such, these requirements apply to cloud products used by agencies, and these federal agencies must sponsor cloud service providers for FedRAMP Authorization to Operate based on their technology needs.
• Third-party Assessments: FedRAMP, unlike FISMA, requires Cloud Solution Providers (CSPs) to undergo regular audits through third-party assessment organizations. These certified security firms provide objective and fair security assessments of CSPs to ensure adherence to regulations.
• Governance: Both FedRAMP and FISMA fall under the jurisdiction of the OMB. FedRAMP, however, includes more organizations as part of its governance structure. The FedRAMP Project Management Office and the Joint Authorization Board include representatives from several agencies, including OMB, Department of Homeland Security (DHS), NIST, and the Department of Defense.

FedRAMP thus serves a significant role in ensuring that cloud products and services, the use of which is rapidly expanding in the government market, adhere to FISMA requirements.

Integrating FISMA With NIST’s Cybersecurity Framework

Organizations can integrate FISMA with NIST’s Cybersecurity Framework by utilizing each component of the Framework to determine their security needs. FISMA provides federal agencies with guidance on how to establish, implement, and manage a comprehensive cybersecurity program. By incorporating the essential components of FISMA—risk management, information security, security testing and evaluation, and reporting requirements—organizations can develop a comprehensive cybersecurity program that meets their unique business requirements and is tailored to their specific environment.

The NIST Cybersecurity Framework can then be used to provide organizations with a standardized set of performance objectives for each component, allowing them to benchmark their security posture and track their progress. Finally, organizations can monitor their adherence to FISMA requirements by using the NIST Cybersecurity Framework as a reference point. This integrated approach will ensure that organizations meet the necessary requirements to protect their systems and data from malicious activities.

Penalties for FISMA Compliance Violations

FISMA compliance violations can result in severe penalties and consequences such as fines, sanctions, or criminal prosecution. Violations of the standards are considered a federal offense, and federal agencies can impose a variety of sanctions including civil fines, criminal penalties, and other administrative enforcement actions.

Potential penalties can range from formal reprimands and financial penalties up to imprisonment, depending on the severity of the violation. Organizations must ensure that they comply with FISMA regulations to avoid the hefty penalties associated with noncompliance. Furthermore, organizations can face additional legal action for negligence in addressing issues that lead to a FISMA compliance violation.

Meeting FISMA Standards and Contributing to National Service

The most important part of standards like FISMA (and even FedRAMP) is that it provides a high level of security for agencies handling critical operational information for government agencies as well as personal information related to U.S. citizens. Therefore, working with government agencies means that contractors may handle such information, and it is their obligation to protect it.

The Kiteworks platform is a cloud-based content management and governance system that empowers organizations to meet compliance standards without compromising enterprise-grade functionality. This includes adherence to complex regulations like FISMA and FedRAMP.

To learn more about Kiteworks, contact us for a free demo tailored to your operations.

Back to Risk & Compliance Glossary