FISMA (The Federal Information Security Management Act), signed into law as part of the Electronic Government Act in 2002, requires all federal agencies to develop, document and implement agency-wide information security programs. FISMA additionally requires federal agencies to provide security for the information and information systems supporting the operations and assets of the agency.

The National Institute of Standards and Technology (NIST) defines the process for compliance, as well as the development and publication of security standards and controls under FISMA. NIST published FIPS 200 (Federal Information Processing Standard), which provides both a specified minimum of security for computer systems as well as a way for agencies to implement sensible risk-based security policies. FIPS 200 additionally provides links to NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems, which recommends managerial, operational and technical controls needed to protect sensitive information and maintain the availability of information systems. Beginning in 2006, all new computer systems built by federal agencies will be required to comply with this standard.

Senior management is held accountable for ensuring the timely implementation of security measures, as well as the integration of security with overall IT management and maintenance processes; failure to comply is not an option for federal agencies. FISMA compliance requires detailed reporting and measurements on security for the agency, both on the existing risks as well as the remediation plans. Verifying compliance for every Windows-based system within the organization requires both comprehensive and continuous monitoring, as well as coordinated detail and summary reporting on critical information. These conditions allow the head of an agency’s IT department to accurately report on his/her current FISMA compliance status.

Key Benefits