What Is FISMA?

The Federal Information Security Modernization Act requires United States federal agencies to develop, document and implement programmes to secure their information and systems.

It applies to agencies rather than to private organisations directly. Contractors and service providers encounter it through their agency customers, who pass the obligations down contractually.

What it requires of agencies

An agency-wide security programme. Periodic risk assessment. Policies and procedures based on that assessment. Security awareness training. Periodic testing of controls.

A process for remediating deficiencies. Incident response procedures and reporting. Continuity planning. And annual independent evaluation, with reporting to oversight bodies.

The control catalogue underneath it

Implementation rests on a national control catalogue, with baselines selected according to the system's categorised impact level. Categorisation considers confidentiality, integrity and availability separately.

That catalogue is the substance of what a contractor actually has to implement, and it is the same one that underpins FedRAMP and, in its non-federal-systems variant, CMMC.

The authorisation process

Systems go through a risk management process: categorise, select controls, implement, assess, authorise, monitor. An authorising official accepts the residual risk and issues an authority to operate.

That authorisation is time-bound and conditional, with continuous monitoring obligations. The shift from periodic reauthorisation toward ongoing authorisation based on continuous monitoring is the main direction of travel.

What it means for contractors

Contract clauses flow the requirements down. A contractor operating a system on an agency's behalf may be subject to the full process including assessment and authorisation.

Cloud services are handled through the dedicated authorisation programme rather than agency by agency, which was the problem that programme was created to solve.

The criticism it attracts

The programme has been persistently criticised as compliance-driven — producing documentation and annual reports rather than measurable improvement, with agencies scoring well while experiencing significant breaches.

Reforms have pushed toward continuous monitoring and measurable outcomes rather than periodic reporting, which is the same direction visible across compliance regimes generally. See compliance.

Annual evaluation and reporting

Each agency undergoes independent evaluation annually, with results reported to oversight bodies and summarised publicly. Inspectors general assess programme maturity across defined functions.

The published results are a useful and underused reference, because they describe recurring weaknesses across a large population of organisations — identity management, configuration management and contingency planning appear persistently, which is informative well beyond the federal context.

The supporting guidance is worth knowing about independently of any federal obligation. Publications covering risk management, protection of sensitive information in non-federal systems, incident handling, contingency planning and authentication assurance are all freely available and are among the more practical reference material in the field.

That is why these documents appear as references in commercial frameworks, insurance questionnaires and customer contracts written by organisations with no federal connection at all.

Contractor obligations are also worth distinguishing from agency ones. A contractor operating a system on an agency's behalf inherits the full process; one merely receiving sensitive information faces the non-federal-systems requirements instead. Establishing which position you are in determines whether you need an authority to operate or a system security plan against a narrower control set.

Where to start

If you contract with federal agencies, read the security clauses in your existing contracts. The obligations are already there and are frequently unexamined until an assessment is requested.

See FedRAMP. GuardsArm delivers NIST 800-53 services.