FISMA Background

 

The E-Government Act (Public Law 107-347) passed by the 107th Congress and signed into law by the President in December 2002 recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA) requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

 

An effective information security program should include:

 

Periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the organization

Policies and procedures that are based on risk assessments, cost-effectively reduce information security risks to an acceptable level, and ensure that information security is addressed throughout the life cycle of each organizational information system

Subordinate plans for providing adequate information security for networks, facilities, information systems, or groups of information systems, as appropriate

Security awareness training to inform personnel (including contractors and other users of information systems that support the operations and assets of the organization) of the information security risks associated with their activities and their responsibilities in complying with organizational policies and procedures designed to reduce these risks

Periodic testing and evaluation of the effectiveness of information security policies, procedures, practices, and security controls to be performed with a frequency depending on risk, but no less than annually

A process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, and practices of the organization

Procedures for detecting, reporting, and responding to security incidents

Plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the organization.

 

FISMA, along with the Paperwork Reduction Act of 1995 and the Information Technology Management Reform Act of 1996 (Clinger-Cohen Act), explicitly emphasizes a risk-based policy for cost-effective security. In support of and reinforcing this legislation, the Office of Management and Budget (OMB) through Circular A-130, Appendix III, Security of Federal Automated Information Resources, requires executive agencies within the federal government to:

Plan for security

Ensure that appropriate officials are assigned security responsibility

Periodically review the security controls in their information systems

Authorize system processing prior to operations and, periodically, thereafter

These management responsibilities presume that responsible agency officials understand the risks and other factors that could adversely affect their missions. Moreover, these officials must understand the current status of their security programs and the security controls planned or in place to protect their information and information systems in order to make informed judgments and investments that appropriately mitigate risk to an acceptable level. The ultimate objective is to conduct the day-to-day operations of the agency and to accomplish the agency's stated missions with adequate security, or security commensurate with risk, including the magnitude of harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. As a key element of the FISMA Implementation Project, NIST also developed an integrated Risk Framework which effectively brings together all of the FISMA-related security standards and guidance to promote the development of comprehensive and balanced information security programs by agencies.

Project Phases

 

Phase I: Standards and Guidelines Development (2003-2007)

The first phase of the FISMA Implementation Project focuses on the development of the security standards and guidance required to effectively implement the provisions of the legislation. The implementation of the NIST standards and guidance will help agencies create robust information security programs and effectively manage risk to agency operations, agency assets, and individuals.

 

The publications include:

• FIPS Publication 199, Standards for Security Categorization of Federal Information and Information System
• FIPS Publication 200, Minimum Security Requirements for Federal Information and Federal Information Systems
• NIST Special Publication 800-30, Revision 1, Risk Assessment Guideline (Completion December 2007)
• NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems
• NIST Special Publication 800-39, NIST Risk Management Framework (Completion December 2007)
• NIST Special Publication 800-53 Revision 1, Recommended Security Controls for Federal Information Systems (Completed)
• NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems (Completion July 2007)
• NIST Special Publication 800-59, Guide for Identifying an Information System as a National Security System
• NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories

 

Phase II: Organizational Credentialing Program (2007-2009)

The second phase of the FISMA Implementation Project will focus on the development of a program for credentialing public and private sector organizations to provide security assessment services for federal agencies. The security services involve the comprehensive assessment of the management, operational, and technical security controls in federal information systems to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.
Organizations that participate in the credentialing program can demonstrate competence in the application of the NIST security standards and guidelines. Developing a network of credentialed organizations with demonstrated competence in the provision of security assessment services will give federal agencies greater confidence in the acquisition and use of such services. Public workshops will be conducted at the beginning of FISMA Phase II to discuss potential organizational credentialing models. Consult this web site for additional details and workshop schedule.

 

Phase III: Security Tool Validation Program (2008-2009)

Phase III of the FISMA Implementation Project has been eliminated as a separate phase, but will be incorporated into Phase II and use existing IT product testing, evaluation, and validation programs.

 

.