The Federal Information Security Management Act of 2002 (FISMA)

The Federal Information Security Management Act of 2002 (FISMA) represents something of a milestone in the world of Cyber Security. Prior to 2002, whilst it was clearly advisable for all Federal Agencies to adopt some sort of formal Cyber Security program, it wasn’t until the FISMA act was passed that this became a requirement. It will be interesting to see if similar requirements become legislation for corporate America! One to watch perhaps?

There is some confusion as to whether or not FISMA is in itself a security framework. Whilst it can be regarded as a framework in so much as it provides direction, it does not provide the actual controls and guidelines that agencies must follow in order to fulfil their obligations. Those guidelines are provided by The National Institute of Standards and Technology (NIST).

FISMA

Requirements

FISMA requires government agencies to implement an information security program that effectively manages risk. NIST provides the specific guidance for complying with FISMA.

What is interesting about this approach is that it establishes formal guidance that ensures agencies fulfill their cyber security requirements whilst also prioritizing the importance of a ‘Risk Based’ approach, which not only creates a program fit for purpose depending on circumstance but also draws particular focus to ‘cost effective’ security.

More recently in 2011, the US Government confirmed the Federal Risk and Authorization Program (FedRAMP) as further legislative guidance for Government Cloud services. This act includes Government Agencies, Suppliers and Service Providers.

To make life easy, think of FedRAMP as FISMA for the Cloud.

For more details about the specific guidelines for FISMA and FedRAMP use the links below:

NIST 800-53 SP
NIST 800-53 | NIST 800-171
NIST 800-171 FAQs | FDCC USGCB

Additional Resources
Latest Resources

CIS

Access CIS Resources
Access a broad range of CIS Benchmark reports to audit your enterprise and continuously monitor for any drift from your hardened state.
Download Reports »

Server Hardening

Server Hardening Resources
Download Hardened Services checklists, derived by NNT in conjunction with Microsoft, to manually audit your servers for compliance.
Download Checklists »

Audit Policy

Audit Policy Template Resources
Gain access to audit policies derived from the Center for Internet Security to generate audit logs on all relevant security levels.
Download Audit Policies »

Contact Us

USA Offices

New Net Technologies LLC
Suite #10115, 9128 Strada Place
Naples, Florida, 34108

New Net Technologies LLC
1175 Peachtree St NE
Atlanta, Georgia, 30361.

Tel: (844) 898-8358
[email protected]

 

UK Office

New Net Technologies Ltd
Rivers Lodge, West Common
Harpenden, Hertfordshire
AL5 2JD

Tel: 01582 287310
 [email protected]

SC Magazine Cybersecurity 500 Infosec Security Winners 2018 CIS benchmarking SEWP Sans Institute Now Certified IBM Security
Copyright 2020, New Net Technologies LLC. All rights reserved. 
NNT and Change Tracker are registered trademarks of New Net Technologies LLC.
All other product, company names and trademarks are the property of their respective owners.