FISMA

FISMA
U.S. Government · Public domain · source
Name	Federal Information Security Management Act
Enacted	2002
Amended	2014
Jurisdiction	United States federal agencies
Status	Active

FISMA

The Federal Information Security Management Act established a framework to protect information systems and data within United States federal civilian agencies. It created obligations for agency heads, Chief Information Officers, and Inspectors General to implement risk-based security standards, continuous monitoring, and annual reporting to Congress and the Office of Management and Budget. The Act influenced subsequent statutes, guidance from the National Institute of Standards and Technology, and oversight by the Government Accountability Office and congressional committees.

Background and Purpose

FISMA originated amid post-1990s concerns about large-scale computer security incidents and the Y2K transition, building on earlier statutes such as the Paperwork Reduction Act and the Computer Security Act of 1987. Responding to recommendations from entities including the National Research Council, the legislation aimed to centralize accountability across executive branch agencies represented in hearings before the House Committee on Government Reform and the Senate Committee on Governmental Affairs. The law sought to promote risk management practices aligned with standards promulgated by agencies like the National Institute of Standards and Technology and to formalize reporting to the Office of Management and Budget and Congress, including oversight from the Government Accountability Office.

Key Provisions and Requirements

FISMA required agency heads to develop, document, and implement agency-wide information security programs consistent with guidance issued by NIST under the Information Technology Management Reform Act framework. Major elements included inventorying information systems, conducting periodic risk assessments, implementing security controls, and authorizing system operation through risk-based certification and accreditation processes linked to Federal Information Processing Standards. The statute mandated annual reviews by agency Inspectors General and reporting to OMB and specific congressional committees such as the House Committee on Oversight and Reform and the Senate Homeland Security and Governmental Affairs Committee. It also emphasized contingency planning, incident response, and training for personnel in roles identified under statutes including the Chief Financial Officers Act of 1990.

Implementation and Compliance

Implementation relied heavily on NIST publications like the NIST Special Publication 800-53 catalog and the development of baseline controls used by agencies such as the Department of Veterans Affairs, the Department of Defense, the Department of Homeland Security, and the Internal Revenue Service. Agencies established Chief Information Security Officer positions and integrated FISMA requirements into enterprise architectures referenced in Clinger-Cohen Act implementation. Compliance processes incorporated automated continuous monitoring tools, patch management programs, and vulnerability scanning used by federal operations centers modeled after practices in the United States Computer Emergency Readiness Team and enterprise programs at the General Services Administration. Inspectors General and independent auditors, including contractors from firms like Deloitte, KPMG, and Ernst & Young, evaluated controls against criteria in NIST guidance and reported findings to OMB and authorizing committees.

Oversight and Enforcement

Oversight came from a combination of executive branch management, independent audit, and legislative review. The Office of Management and Budget issued memos and circulars to translate statutory mandates into agency-level requirements, while NIST produced technical standards to guide implementation. The Government Accountability Office produced periodic reports on federal information security posture, presenting to panels such as the Senate Committee on Appropriations and the House Permanent Select Committee on Intelligence as relevant. Where deficiencies were found, remedies included corrective action plans, withholding of funds under appropriations jurisdiction, and public reporting of material weaknesses in agency financial and information systems tied to statutes like the Federal Information Security Modernization Act of 2014 amendment process.

Impact and Criticisms

FISMA reshaped federal information security by institutionalizing risk management, elevating the role of Chief Information Security Officers, and spurring the development of the NIST Risk Management Framework used by agencies including the Federal Bureau of Investigation and Centers for Medicare & Medicaid Services. Critics argued that FISMA fostered checkbox compliance, emphasizing annual reporting over continuous security, and that metrics required by OMB sometimes drove form over function. Commentators from the Project on Government Oversight and experts at universities such as Carnegie Mellon University and Harvard University highlighted gaps between statutory requirements and operational cybersecurity, citing incidents affecting the Office of Personnel Management and breaches reported in GAO investigations. Industry groups like the Information Technology Industry Council and standards bodies including the International Organization for Standardization noted the need for alignment with international practices.

Related Legislation and Amendments

FISMA was superseded in part by statutory reform and executive guidance, notably the Federal Information Security Modernization Act of 2014, which clarified authorities involving the Department of Homeland Security and incident response responsibilities. Additional intersecting laws and directives include the E-Government Act of 2002, the Homeland Security Act of 2002, the Cybersecurity Information Sharing Act of 2015, and appropriations statutes that condition funding on security posture. Relevant executive orders, including those issued by Presidents such as George W. Bush and Barack Obama, further shaped implementation timelines and priorities, while later administrations referenced FISMA-related frameworks in strategies presented to Congress and interagency groups like the National Security Council.

Category:United States federal legislation