Getting compliant can be a difficult process, and while our compliance services are a great help, it’s always good to know what you’re signing up for.
In this guide, we’ll talk you through everything you need to know about FISMA compliance.
From what it is, to who must comply, and the steps you should take.
So if you’re worried about FISMA compliance, don’t be.
We’ve made it nice and easy to understand and comprehend, so read on.
What is FISMA (Federal Information Security Management Act)?
FISMA is the Federal Information Security Management Act which was passed as a United States Federal Law in 2002. It makes it a legal requirement for federal agencies to develop, implement, and maintain an information security and protection program.
What is FISMA Compliance
FISMA compliance is meeting the requirements set forth by FISMA. We’ve outlined the steps to getting FISMA compliant below. In short, it’s a requirement for you to actively take steps to ensure that data and information are handled and kept securely. The standards for this were developed by the National Institute of Standards and Technology (NIST), namely the FIPS 199, FIPS 200, and NIST 800 series.
Who Must Comply with FISMA?
Initially, FISMA compliance was meant for federal government agencies, hence the name. However, over time it has also expanded to include state agencies such as Medicare. Furthermore, it now also requires any company and civilian agencies with a contractual relationship with the government to be FISMA compliant.
How Do I Become FISMA Compliant?
FISMA requirements and compliance is a huge in-depth topic and something that requires a lot of research and setup. Both of which UTMStack is able to help you with.
Information Systems Inventory
Every company must maintain an inventory of information systems utilized within the organization. This includes everything from the lonely printer to the central server. Furthermore, the integrations and communications between these systems must be clearly documented. This goes for internal and external communications too.
Risk Categorization
Organizations must use the FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems) guidelines to create a risk management profile. This means arranging systems according to risk levels. Clearly, some items such as the central server will have a much higher risk level than the printer in the lobby. Understandably, the former will need in-depth attention, while the latter will have minimum security requirements.
System Security Plan
FISMA requires agencies to create a plan of all the steps taken to meet compliances. This plan and the systems need continuous monitoring, and both of them need to be amended if any situation changes.
Security Controls
NIST SP 800-53 outlines the security controls that must be implemented for FISMA compliance. Not all of the controls, within the guidelines, are required to be implemented. Instead, the security controls required are determined by the risk assessment.
Risk Assessments
NIST SP 800-30 offers some guidance on how agencies should conduct risk assessments. Risk assessment is the task of identifying risks to the information systems. The risk management framework should be three-tiered: business process level, organization level, and information system level. This circles back to risk categorization.
Certification and Accreditation
Unsurprisingly, it’s not enough to develop, document, and implement steps with regard to security risks. The government also conducts an annual security review. Therefore, for a federal agency or private business to gain FISMA Certification and Accreditation they need to pass a four-phased
Benefits of Compliance
FISMA compliance has two main benefits, one is for the public, and the other is for government agencies and businesses.
Firstly, compliance means that not only government information but also personal information is handled more securely across the United States. This benefits the public as it provides them with a higher level of peace of mind.
The other benefit is for federal agencies and organizations. Most importantly they can keep information security incidents lower which is better for customer and company reputation. Secondly, by meeting FISMA compliance requirements businesses are more likely to land government contracts, which tend to be extremely high value.
Penalties
Of course, a set of government guidelines on information security systems and security standards wouldn’t be complete without the possibility of penalties and repercussions. Of course, these are layered and are reasonable. As long as you follow best practices for data protection, and you don’t commit any major issues or have any data breaches you’ll be fine.
Penalties can range from simple financial to censure by congress or even a reduction in federal funding. Of course, depending on the federal agencies involved and federal information systems that are involved it could even include a high dose of reputational damage.
FedRAMP Program
Despite popular belief, FISMA, and other information security requirements on data don’t mean that you can’t use a public cloud service. In-fact, data security is the main aim, and in many instances using a trusted cloud provider could be more secure than hosting your own server. Understandably, any cloud service provider that is used by any company or agency that is required to be FISMA compliant, must be FISMA complaint itself.
To help with this the government has set up the Federal Risk and Authorization Management Program FedRAMP. FedRAMP helps ramp up the approach to security assessment, authorization, and monitoring for cloud products using a standardized approach.
Frequently Asked Questions
Here are some commonly asked questions about FISMA compliance.
What is the difference between FISMA and NIST?
FISMA is the compliance act itself, while NIST develops the rules and guidelines for the act.
How many NIST security controls are there?
The National Institute of Standards and Technology Special Publication (NIST SP) 800-53 contains a wealth of security controls. NIST SP 800-53 R4 contains over 900 unique security controls that encompass 18 control families.
Why is FISMA important?
FISMA is important as it means that sensitive information is kept safe and secure. With more and more of our personal details being digital this is something to be aware of.
Is AWS FISMA compliant?
Yes. AWS has received Federal Information Security Management Act (FISMA) Moderate Authorization and Accreditation from the U.S. General Services Administration.
FISMA – Why You Should Care
So there you have it. Everything you need to know about FISMA and the security requirements that come with it. If you haven’t yet, you should ensure that you become FISMA complaint as quickly as you can. Not only will it help secure your data and information systems, which is beneficial for both you and your customers, it could also help you land some valuable government contracts.
Luckily, FISMA is similar to many other compliances such as SOC, HIPPA, and GDPR. So if you’re compliant in one, you can easily become compliant in the other. If you need help, then talk to us and we’ll get you going on the right track.
Leave a Reply