FISMA, or the Federal Information Security Management Act of 2002, is a law aimed at safeguarding government information, operations, and assets from both natural and human-made threats. The law requires all federal agencies to develop, document, and implement information security programs covering their entire organization. Agency officials and heads are also required to conduct annual reviews of their security programs to ensure that risks are kept at or below acceptable levels.

FISMA applies to all government agencies at the federal level, as well as to state agencies responsible for managing programs sponsored by the federal government and private companies that partner with government agencies.

To be FISMA-compliant, agencies must categorize their information systems based on their risk levels. This process takes into account the type of information contained in or processed by a system and determines the required security controls. The highest level of security is given to sensitive information and High-Value Asset (HVA) systems.

The FISMA certification and accreditation process consists of four phases: initiation and planning, certification, accreditation, and continuous monitoring. The National Institute of Standards and Technology (NIST) is responsible for developing the standards and policies that agencies use to ensure their systems, applications, and networks remain secure. The details of this process are outlined in NIST SP 800-37 Guide for the Security Certification and Accreditation of Federal Information Systems.

How can STS help? We can help align your business with FISMA requirements in several ways:

Risk assessment: Perform a risk assessment to identify the security risks and vulnerabilities in information systems and develop a risk management plan to mitigate those risks.

Security control selection: Select security controls based on the risk assessment and your specific security needs.

Security control implementation: Implement the selected security controls and provide guidance on best practices for configuring and managing those controls.

Security documentation: Prepare documentation required for FISMA compliance and accreditation, including system security plans, contingency plans, and incident response plans.

Accreditation support: We support you throughout the accreditation process, including preparing for and participating in accreditation reviews and audits.