What Is FISMA?
FISMA stands for the Federal Information Security Modernization Act and was originally enacted in December 2002, establishing the importance of information security principles and practices within the Federal Government and noting that information security was “critical to the economic and national security interests of the United States.” The emphasis of FISMA was to establish a “risk-based policy for cost-effective security.”
With the passage of FISMA, each Federal agency became responsible for developing and implementing an information security program for the information systems under its control, including any information systems managed by contractors on behalf of the agency. The goals of FISMA were to reduce information security risk and expenditures for the Federal agencies; specifically, they were to implement adequate security, or security commensurate with risk.
FISMA Overview: Guidelines to Help Understand FISMA
In order to meet the risk-based mandate established by FISMA, NIST published standards that define repeatable processes to assist those who are responsible for meeting FISMA. It all starts with FIPS-199, which requires federal information systems to be categorized into one of three categorizations: high, moderate, or low, based on the potential harm caused to confidentiality, integrity, or availability (CIA triad). Controls in NIST 800-53 (currently on Rev 5, September 2020) are mapped to the associated categorizations defined in FIPS-199, and systems must implement the control baseline associated with their categorization.
NIST SP 800-37 (Rev 2, December 2018) defines the Risk Management Framework, which is a seven-step process (see below) that agencies and contractors follow to select, implement, assess, authorize, and then continuously monitor. There are dozens of additional guidelines and special publications issued by NIST covering topics such as risk assessments, security planning, conducting risk assessments, continuous monitoring, etc.
This image has been modified from its original source.
How Does the Risk Management Framework (RMF) Fit Into FISMA?
The relationship between FISMA and the RMF is best described as a partnership. FISMA is federal law and describes the “why” for information security, whereas the RMF describes the “how” to implement information security in federal systems. The NIST RMF is a core component of FISMA compliance. The RMF translates the FISMA “legalese” into repeatable step-by-step security practices.
FISMA explicitly delegates to NIST the responsibility of developing the frameworks and standards to meet FISMA requirements. Below is a mapping between some of the FISMA mandates and the RMF steps:
- FISMA mandate: Categorize information systems
- RMF step 2: Categorize Information System
- FISMA mandate: Implement security controls
- RMF step 3: Select Security Controls
- RMF step 4: Implement Security Controls
- FISMA mandate: Conduct Independent Assessments
- RMF step 5: Assess Security Controls
- FISMA mandate: System Authorization
- RMF step 6: Authorize Information Systems
- FISMA mandate: Continuous Monitoring
- RMF step 7: Monitor Security State
The RMF provides a flexible lifecycle that links directly to organizational risk tolerance. Under the RMF, FISMA compliance is a byproduct of running a strong, risk-aware security architecture rather than a burdensome documentation exercise. The last step of the RMF, Monitor, keeps the security state at the forefront of day-to-day operations. This is done through regular vulnerability scans, configuration management, annual security assessments, etc. The RMF gives technical instructions regarding FISMA implementations, and FISMA gives the RMF regulatory authority.
What Is the Role of Federal Agencies with Regard to FISMA?
Another large focus of FISMA was to specifically detail responsibilities under the Act between the Federal agencies, NIST, and the Office of Management and Budget (OMB). Under FISMA, the following responsibilities were defined:
- Federal Agencies: Develop and implement an integrated risk-based information security program. As part of this effort, Federal agencies were responsible for identifying all of their information systems, categorizing their information systems, defining and implementing applicable controls, testing the controls, and continuously monitoring their implementation to verify the controls are operating effectively and align with FISMA standards.
- NIST: Develop the security guidelines and standards for implementation across all Federal agencies. These include guidelines and standards for categorization of information systems, comprehensive definition of security controls and risk management methodologies, among others.
- OMB: Define and implement methods for oversight (e.g., define a standardized process for reporting FISMA compliance). Report to Congress on the status of FISMA compliance across the Federal government.
What Is FISMA Compliance?
So, what does it mean to be FISMA compliant? Is there a FISMA certification that organizations can get to demonstrate that they are FISMA compliant? In short, the answer is no. So how does an organization determine whether they are FISMA compliant? Both government agencies and commercial entities supporting a government contract to process, store, or transmit government data must demonstrate compliance with FISMA.
In short, they must categorize their system and identify the controls that need to be implemented. Then they must demonstrate that they’ve implemented the controls identified in NIST 800-53 and developed the associated supporting policies, processes, and procedures to support the secure operation of the system. The assessment of the security controls should be conducted by an independent assessor with a background and experience with the NIST 800-53 controls, the assessment processes, and the ability to document compliance with the controls.
Based on the outcome of the assessment of the controls, an Authorizing Official (AO) will determine if the risk is acceptable to allow the system to operate in “production,” or to process, store, and transmit “live” government data. An AO is “a senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations. This includes mission, functions, image or reputation, organizational assets, individuals, other organizations, and the Nation” (NIST SP 800-37 Rev. 2). The AO determines whether the system sufficiently protects the confidentiality, integrity, and availability of the system and, therefore, accepts the risk and responsibility for the security of the system. If the risk is sufficiently low, then the AO will grant an ATO, which is an Authority to Operate. Receiving an ATO essentially demonstrates FISMA compliance. The process doesn’t stop with the receipt of an ATO. Each year, the program must demonstrate through continuous monitoring that the security controls are still in place and operating effectively.
If a commercial entity supports multiple government agencies, then they may have to get multiple ATOs, as each government agency may have slightly different requirements, standards, and risk appetites. FISMA compliance and granting an ATO are very much individual agency determinations and lack reciprocity between the government agency AOs.
What Is the Difference Between FISMA & FedRAMP from an Assessment Perspective?
FISMA assessments cover all types of federal information systems and are agency-specific, while FedRAMP assessments apply exclusively to cloud services and are designed to be reusable across multiple agencies. The scope of a FISMA assessment is defined by the agency and its systems, whereas the scope of a FedRAMP Rev 5 assessment is defined by the boundaries of the cloud service offering.
From an assessor’s perspective, both FedRAMP and FISMA assessments are grounded in the NIST RMF and NIST SP 800-53 controls, but they differ in scope, rigor, and specific requirements due to their intended audiences and regulatory objectives. FISMA assessments apply to every federal agency and its specific information systems (often considered “on premise” and non-cloud-based systems). FedRAMP assessments are targeted specifically to commercial cloud service providers (CSPs) and their cloud service offerings (CSOs). FedRAMP assessments make sure that CSOs meet the federal security requirements before agencies use them. Below is a table comparing the FISMA and FedRAMP Rev 5 assessment processes.
| Attribute | FISMA Assessments | FedRAMP Assessments |
| Assessment scope | Federal agency information systems | Commercial cloud service offerings used by federal agencies |
| Assessor | Internal or external | A2LA-accredited independent assessor |
| Control baseline | NIST 800-53 (High, Moderate, Low baselines) | NIST 800-53 (High, Moderate, Low baselines; additional overlays may apply depending on the situation) |
| Documentation | Agency-defined (but the SSP is the core document) | FedRAMP templates (but the SSP is the core document) |
| Assessment rigor | Varies by agency, system, and risk categorization | Very rigorous, prescriptive, and standardized |
| Reuse | None | Across federal agencies (note: each agency must issue its own ATO). |
While FISMA and FedRAMP are both rooted in the NIST RMF to protect federal data, they apply to different environments. FISMA is a law that mandates comprehensive cybersecurity programs for federal agencies and the internal systems they own or operate. In contrast, FedRAMP is a government-wide program that specifically adapts those FISMA standards for commercial cloud service providers. Ultimately, FISMA governs the overall security posture of government agencies, while FedRAMP streamlines the process for those agencies to safely adopt secure, external cloud technologies.
Frequently Asked Questions About FISMA Compliance
Navigating FISMA can raise a lot of questions, especially for contractors encountering federal compliance requirements for the first time. Below are answers to some of the most common questions we hear about FISMA compliance.
What Are the Different Levels of FISMA Compliance?
As defined by FIPS-199, federal information systems are categorized as low, moderate, or high impact based on the potential harm to the CIA of the system. This impact level defines the NIST SP 800-53 controls that are required for implementation. The higher the impact level, the more controls that have to be implemented.
What Are the Key Components of FISMA Compliance?
As identified above, the primary components of FISMA compliance are to categorize the information system, select and implement the NIST 800-53 controls as defined by the impact level, independently assess the controls, obtain an Authorization to Operate (ATO) by an Authorizing Official (AO), and then, once the ATO is received, continuously monitor the effectiveness of the controls.
Is FISMA Compliance Mandatory?
Since FISMA is federal law, yes, compliance is mandatory. It applies to all federal agencies and supporting contractors that operate an information system on behalf of the federal agency, or if they handle federal data. Requirements can be tailored or scoped to the information system.
Does FISMA Require the Use of NIST 800-53?
Yes. FISMA directed NIST to develop the security standards that federal agencies must implement for their federal systems, and NIST 800-53 is that control catalog that defines the controls and their associated baseline (low, moderate, or high).
Who Has to Comply with FISMA?
Complying with FISMA is the responsibility of every federal agency, or any other organization (e.g., contractors, commercial entities, etc.) that processes, stores, or transmits federal data, or that operates an information system on behalf of a federal agency.
How Does An Organization Become FISMA Compliant?
Since there is no FISMA certificate, organizations must have an independent assessment of the controls that were selected based on the system categorization (low, moderate, or high). These controls are selected, implemented, and tested. Then an AO grants an ATO if the risk is acceptable. Once obtained, the ATO is maintained through continuous monitoring of controls.
Ready to Pursue FISMA Compliance? Here’s What to Do Next
As part of its responsibilities under FISMA, NIST has done an outstanding job of developing comprehensive information security standards and guidelines. In addition to the above-mentioned documents, there are many more covering various other aspects of an information security program. While developed for the Federal government, NIST documentation can be leveraged to enhance any commercial information security program as well.
As mentioned previously, the assessment of NIST 800-53 security controls and supporting documentation, policies, and procedures should be conducted by an independent assessor with a background and experience with the NIST 800-53 controls, the assessment processes, and the ability to document compliance with the controls.
Linford & Co personnel have over 20 years of combined experience leading successful FISMA-compliant security engineering efforts for highly complex programs supporting the acquisition, processing, and reporting of satellite data for the Department of Defense and Intelligence agencies. Please contact us if you’d like to know more about FISMA compliance or get a FISMA audit for your organization.
This article was originally published on 11/29/2017 and was updated on 8/26/2026.
