FISMA

Who it applies to

US federal agencies and contractors operating systems on their behalf.

Key requirements

• An agency-wide information security program led by the agency head and CISO.
• Categorisation of systems (FIPS 199) and minimum security requirements (FIPS 200).
• Selection and implementation of NIST SP 800-53 controls under the Risk Management Framework (SP 800-37).
• Authorisation to operate and continuous monitoring.
• Annual reporting and independent evaluation by the Inspector General.

Breach and incident notification

Agencies report incidents to CISA and notify Congress of major incidents, following OMB guidance on timing.

Penalties

Administrative and budgetary consequences for agencies rather than fines.

Go deeper