FISMA
Federal Information Security Modernization Act documentation for systems supporting federal operations, including continuous monitoring requirements, annual control assessments, and FISMA reporting deliverables.
What FISMA is
The Federal Information Security Modernization Act sets the requirement that federal agencies, and the contractors and service providers operating systems on their behalf, secure their information and information systems. It frames security as an ongoing risk management responsibility rather than a one time checklist.
FISMA implementation follows NIST guidance, principally the Risk Management Framework and the 800-53 control catalog, so FISMA documentation and 800-53 documentation share the same foundation.
Who it applies to
FISMA reaches federal agencies and any organization that operates or maintains a system supporting federal operations.
- —Federal civilian agencies and their program offices
- —Contractors and service providers running systems for an agency
- —Shared service providers whose systems agencies depend on
The Risk Management Framework
FISMA work is organized around the NIST Risk Management Framework, which moves a system through a defined lifecycle and keeps it under review after it goes live.
- —Categorize the system by impact level
- —Select and implement the applicable controls
- —Assess whether the controls work as intended
- —Authorize the system to operate
- —Monitor controls continuously and report on them
The core documentation
FISMA compliance is evidenced in writing, and most of the artifacts carry over from one assessment cycle to the next.
- —System Security Plan and supporting policies
- —Risk assessments and security control assessments
- —Plan of Action and Milestones for open findings
- —Continuous monitoring records and annual FISMA reporting
Continuous monitoring and annual reporting
FISMA does not end at authorization. Agencies and their providers are expected to monitor controls on an ongoing basis and report on their security posture each year, which keeps the documentation a living requirement rather than a single deliverable.
How Verdict helps
Verdict drafts FISMA documentation grounded in the controls your system has to meet, then federal practitioners finalize it to the standard an assessor expects. The result is the same package, produced in a fraction of the manual time.
Whether you are standing up a new system or maintaining an authorization, we can map your FISMA work.
Talk to an Advisor