FISMA

What Is FISMA?

The Federal Information Security Management Act (FISMA) is a United States federal law enacted in 2002 to improve the security of government information systems. FISMA requires federal agencies to develop, document, and implement an information security program to protect their information and information systems from threats. FISMA also requires agencies to conduct periodic risk assessments and to report their security posture to the Office of Management and Budget (OMB).

Description

FISMA is a United States federal law that requires federal agencies to develop, document, and implement an information security program to protect their information and information systems from threats.

Usage and Examples

FISMA requires federal agencies to develop and implement an information security program that includes risk assessments, security controls, and reporting to the OMB. For example, the Department of Defense (DoD) has implemented the Risk Management Framework (RMF) to comply with FISMA requirements. The RMF includes six steps: Categorize, Select, Implement, Assess, Authorize, and Monitor. Each step must be completed in order to comply with FISMA requirements.