What is FISMA Compliance?
Table of Contents
- What is the Purpose of FISMA?
- Understanding the FISMA Compliance Requirements
- Information System Inventory
- Risk Assessments
- Risk Categorization
- Security Controls
- System Security Plan (SSP)
- Certification and Accreditation
- Continuous Monitoring
- Benefits of FISMA Compliance
- Penalties for FISMA Non-Compliance
- What are FISMA Compliance Best Practices?
- The Importance Of FISMA Compliance
- By Bree Ann Russ
- Sep 18, 2023
The Federal Information Security Management Act (FISMA) was introduced as part of the E-Government Act of 2002. This act required Federal Organizations to implement an information security accreditation process designed to protect government data more efficiently.
Rather than commit every agency to a specific plan, FISMA created guidelines and minimum standards instead. This flexible approach was necessary due to the many industry types it would affect. Afterward, these standards grew in scope to cover state-level agencies and government contractors as well.
FISMA set a vital baseline for government cybersecurity and forced agencies to keep pace with the rapid expansion of the internet during those years. Here are some of the many benefits and requirements set by FISMA and will help you understand the minimum standards you should strive to meet.
What is the Purpose of FISMA?
FISMA existed to prevent Federal leaks that could damage national security or lead to identity theft. It did this by holding agencies accountable for creating and maintaining high standards. Many of these standards revolved around careful assessment, documentation, and future planning of security policies within an agency.
The chief information officer (CIO) or a designated official implements the necessary policies. After an integration period, the agency performs a review to determine if the changes have effectively reduced its security risks.
The Office of Management and Budget compiles the reviews and subsequently reports to Congress. Additional stipulations were added in 2010 requiring agencies to send ongoing system information to FISMA so the data could be analyzed in real-time.
Understanding the FISMA Compliance Requirements
Any US government or government-contracted agency must abide by FISMA's standards for information security. The act created seven primary criteria that must be included in all information system infrastructure. These criteria are further expanded on by the National Institute of Standards and Technology (NIST).
Information System Inventory
The first compliance requirement is to keep an up-to-date and accurate log of the agency's information systems. This inventory must include a run-down of how these systems intersect with each other and does not exclude any systems not directly managed by the agency.
Risk Assessments
The NIST specifies that risk assessments should be performed at the organizational, business process, and information system levels. This is an essential step to FISMA compliance as it is what informs multiple other requirements. The risk assessment process involves identifying the risks, preparing countermeasures, and measuring the effectiveness of those countermeasures.
Risk Categorization
Risk categorization aims to determine which systems need the most attention and precautions. For example, losing a database storing customer credit cards is a greater risk than a database holding a client's initials. The amount of security a system needs is generally determined by the following factors:
- The likelihood of being compromised
- The magnitude of the danger if compromised
- How connected the system is (access points available to attackers)
- Ease of response and recovery to the system
Security Controls
Security controls is the more technical term for defensive measures. Everything from firewalls to employee education falls under the security control umbrella. The NIST created a lengthy catalog of spreadsheets detailing what threats to watch out for and recommended controls against them. Those documents can be found here.
However, FISMA doesn't force agencies to adopt the entire recommended catalog. It's up to each organization to determine which security controls are necessary for their operations. The Office of Management and Budget later reviews the validity of the chosen controls.
System Security Plan (SSP)
A system security plan is an official document outlining an agency's security requirements and the security controls used to meet those requirements. A well-made SSP not only explains each employee's role in data control but it also outlines the agency's future plans to improve its defenses.
The SSP isn't a "one-and-done" document. FISMA compliance requires the SSP to be updated at least once a year to keep up with advances in cyber-attacks. It will be an essential factor in the certification and accreditation process.
Certification and Accreditation
When every other step is accounted for, agencies must send their system security plan to a FISMA representative for approval. The representative determines whether the agency's chosen security controls are enough to mitigate the risk factors. In some cases, the review may even uncover that the agency has gone too far and is misusing its budget.
If everything passes muster, then the agency is accredited and becomes responsible for following through on any promises made in its system security plan.
Continuous Monitoring
Agencies are annually reviewed to ensure they maintain FISMA's security standards. Additionally, they must report any changes to configuration or controls that deviate from the initially accredited plan. Even non-Federal organizations are recommended to create an internal body to keep their infrastructure accountable.
Benefits of FISMA Compliance
FISMA is a framework designed to minimize security risks in the most cost-effective way possible. The thorough review process and monitoring also reduces the chance of system oversights that may occur over time due to negligence.
Even businesses working in the private sector can benefit from FISMA compliance. For starters, being compliant makes your company more likely to succeed in bids for Federal contracts. Also, applying specific FISMA policies to your day-to-day operations will likely raise the efficiency of your overall security infrastructure.
Penalties for FISMA Non-Compliance
Failing to meet FISMA compliance can lead to funding cuts and official censure from the government. A censure is a "formal statement of disapproval" and basically acts as a black mark on a permanent record.
Censure is significantly more impactful for third-party contractors, as a public reprimand will negatively impact a company's reputation in future bids.
What are FISMA Compliance Best Practices?
FISMA compliance was one of the backbones of national security. However, maintaining compliance isn't easy and requires significant planning and resources. Private-sector companies hoping to win Federal contracts should introduce the following routines into their existing systems.
Classify Data in Real-Time
Depending on the industry, a company has mind-boggling volumes of data coming in. On the extreme end, Google handles roughly 2.5 exabytes daily. That's over 2.5 billion gigabytes.
While you probably don't have the same load, waiting until you need FISMA compliance to start classifying data is a mistake. Make it a habit to separate and rank incoming information based on its threat level.
Encrypt Your Data
This is a must-do for any business handling personally identifiable information online. Doing this is the bare minimum for FISMA compliance and is easy to set up. Most storage services, Amazon included, offer customizable encryption options.
Document FISMA Compliance
This is more of a housekeeping recommendation. To quickly receive accreditation, it's best to maintain up-to-date proof of your FISMA compliance. Getting everything ready can take a while, putting you behind a more well-prepared competitor.
The Importance Of FISMA Compliance
FISMA created a framework of security standards that protected Federal agencies for over a decade. It was made when cybersecurity was in its adolescence and continued to stay relevant alongside growing threats.
As of 2014, the Federal Information Security Modernization Act has succeeded the Federal Information Security Management Act. However, the changes in FISMA were primarily restricted to minor amendments and clarifications rather than sweeping changes. The core aspects of FISMA have remained relatively unchanged.
Maintaining FISMA compliance is recommended for any organization, even if it’s not applying for accreditation. However, there’s a huge number of other actions that can strengthen your existing information systems. If you want to learn about your options, InfoPay’s team is always ready!
