FISMA — Federal Information Security Modernization Act
- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeRegulationLegal InstrumentActSectorGovernment SectorIndustryGovernment & Public Sector
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherUnited States Congress (enacted); overseen by OMB, administered by DHS through CISA, standards by NIST
- VersioningVersionFederal Information Security Modernization Act of 2014 (Pub. L. 113-283, 128 Stat. 3073), 44 U.S.C. 3551 to 3558Effective DateDecember 18, 2014Issue DateDecember 18, 2014
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Act is a U.S. public law published free of charge on govinfo.gov and in the United States Code.
Framework text is licensed by its publisher and is included only where stated above.
- FISMA (Public Law 113-283) makes the head of every federal agency responsible for protecting the agency's information and systems, including contractor-operated systems.
- Approved December 18, 2014, it replaced the Federal Information Security Management Act of 2002 in full.
- OMB sets policy and reports to Congress yearly; DHS, through CISA, issues binding operational and emergency directives.
- Agencies run the section 3554(b) program: risk assessments, security plans, training, annual testing, remediation, incident procedures, and continuity plans.
- FIPS 199 categorization, NIST SP 800-53 controls, authorizations to operate, and FedRAMP all exist because the Act requires them.
Overview
The Federal Information Security Modernization Act of 2014 (FISMA, Public Law 113-283, 128 Stat. 3073) is the U.S. statute, codified at 44 U.S.C. 3551 to 3558, that makes the head of every federal agency responsible for protecting the agency's information and information systems, including systems operated by contractors on its behalf, and that gives the Office of Management and Budget oversight and the Department of Homeland Security operational authority over civilian agency security. It was approved on December 18, 2014 and replaced the Federal Information Security Management Act of 2002 in full.
Congress enacted the law; OMB's Director sets policy and reports to Congress each year by March 1 (section 3553(c)); the Secretary of Homeland Security, acting through CISA, issues binding operational directives and emergency directives and runs the federal incident center (sections 3553(b) and 3556); and the standards agencies must follow are the FIPS and NIST guidance made compulsory under 40 U.S.C. 11331. National security systems and Department of Defense and intelligence community systems fall under their own authorities (sections 3553(d) and (e), 3557).
Agencies comply by running the agency-wide program in section 3554(b): periodic risk assessments, risk-based policies, security plans for networks and systems, awareness training, testing at least annually, remediation, incident procedures and continuity plans. The agency CIO and a senior agency information security officer run it, an Inspector General or independent auditor evaluates it every year (section 3555), and a major incident must be reported to Congress within seven days.
Why does it matter?
FISMA is the root of every federal security requirement that contractors and cloud providers meet: FIPS 199 categorization, NIST SP 800-53 controls, authorizations to operate and FedRAMP all exist because the Act requires agency heads to protect systems operated on their behalf. It also defines who may compel an agency to act and how quickly an agency must tell Congress when something goes wrong.
Key benefits include:
- Accountability at the top
Section 3554(a) makes the head of each agency responsible for protection commensurate with the risk and magnitude of harm, and requires security to be built into strategic, operational and budget planning.
- Binding standards
Under 40 U.S.C. 11331 the Secretary of Commerce makes NIST information security standards compulsory and binding, so FIPS 199, FIPS 200 and the SP 800-53 baselines are not optional for agencies.
- Directives with force
DHS may issue binding operational directives, compulsory directions to safeguard federal information from a known threat (section 3552(b)(1)), such as CISA's BOD 26-04 on prioritizing security updates.
- Independent evidence
Section 3555 requires an annual independent evaluation by the Inspector General or an external auditor, testing a representative subset of systems, with results summarized in OMB's report to Congress.
- Fast incident reporting
Agencies must notify the designated congressional committees of a major incident not later than seven days after there is a reasonable basis to conclude it occurred (section 3554(b)(7)).
How does it work?
The Act assigns roles. The OMB Director oversees agency policies, ensures adoption of the section 11331 standards, approves or disapproves agency programs and reports to Congress by March 1 each year (section 3553(a) and (c)). The Secretary of Homeland Security administers implementation for civilian systems, issues binding operational directives, monitors compliance, convenes agency officials and, under subsection (h), may issue emergency directives against a substantial threat.
Each agency head delegates compliance to the Chief Information Officer, who designates a senior agency information security officer whose primary duty is information security (section 3554(a)(3)). The agency-wide program in section 3554(b) runs through the NIST process: categorize the system under FIPS 199, select and implement the SP 800-53 baseline, test controls at least annually, remediate deficiencies, respond to incidents and report them to the federal incident center, and keep continuity plans.
Oversight closes the loop. Agencies report annually to OMB, DHS, Congress and the Comptroller General on major incidents, total incidents and breaches of personally identifiable information (section 3554(c)); the Inspector General evaluates the program each year (section 3555); and the Comptroller General periodically reports on government-wide adequacy. Section 2(d) of the Act requires breach notification policies with notice to Congress within 30 days of discovery of a breach and prompt notice to affected individuals.
Key Elements
- Section 3551, purposes
A comprehensive framework for information security controls over federal information resources, government-wide oversight, minimum controls and automated continuous diagnosis.
- Section 3552, definitions
Defines binding operational directive, incident (an occurrence that jeopardizes integrity, confidentiality or availability without lawful authority), information security, national security system and Secretary (of Homeland Security).
- Section 3553, OMB and DHS authority
OMB policy and oversight; DHS binding operational directives, compliance monitoring, technical assistance, threat hunting and emergency directives; the annual March 1 report.
- Section 3554, agency responsibilities
Agency head accountability, CIO delegation, the eight-element agency-wide program, seven-day major incident notification and the annual agency report.
- Section 3555, annual independent evaluation
Inspector General or independent external auditor tests a representative subset of systems; national security systems are evaluated only by a designated entity.
- Sections 3556 to 3558
The federal information security incident center under DHS, the duties of agencies operating national security systems and the rule that nothing in the subchapter alters privacy, FOIA or records authorities.
What does it cover?
FISMA applies to every federal agency as defined in 44 U.S.C. 3502 and to the information and information systems they use, including systems operated by contractors or other organizations on an agency's behalf. Civilian systems answer to OMB and DHS; national security systems, Department of Defense systems and intelligence community systems are governed by the Secretary of Defense and the Director of National Intelligence under sections 3553(e) and 3557. Private companies are reached through their contracts and through programs such as FedRAMP.
What are its objectives?
FISMA sets the governance under which every federal information system is secured, authorized and watched.
Make agency heads, CIOs and senior security officers accountable for protection commensurate with risk.
Bind agencies to the NIST standards made compulsory under 40 U.S.C. 11331.
Give OMB and DHS the authority to oversee, direct and assist civilian agencies.
Require annual testing, independent evaluation and reporting to Congress and GAO.
Ensure incidents and breaches are reported to the incident center, Congress and affected individuals.
Move oversight toward automated continuous diagnostics and away from paper reporting.
Framework in Context
FISMA 2014 amended chapter 35 of title 44 and superseded the 2002 Act (Title III of the E-Government Act, Public Law 107-347). It is implemented through OMB Circular A-130, which section 2(f) required OMB to revise, the NIST Risk Management Framework (SP 800-37) and SP 800-53, and CISA's directives. FedRAMP (44 U.S.C. 3607 to 3616) operates inside FISMA for cloud services, and the FedRAMP Authorization Act expressly preserves OMB's and DHS's FISMA authorities.
Common Framework Mappings
Organizations map FISMA to complementary standards and guidance to align federal controls with enterprise risk management, cloud authorization, and control baselines for compliance and security operations.
Mapped frameworks include:
CIS Controls v8.1
COBIT 2019
FedRAMP Rev. 5
ISO 27001:2022
NIST CSF 2.0
NIST 800-171 Rev. 3
NIST 800-37 Rev.2
NIST 800-53 Rev.5
How SmartSuite Supports FISMA
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold the section 3554(b) program elements, the SP 800-53 baseline for each system and the evidence for the annual test, Cyber & IT Risk for the risk assessments and incident records the Act requires, and Internal Audit Management to prepare the section 3555 independent evaluation.
System Inventory and Categorization
List each information system, including contractor-operated ones, with its FIPS 199 category, owner, authorizing official and authorization status.
Program Element Tracker
Map the eight section 3554(b) elements (risk assessment, policies, subordinate plans, training, testing, remediation, incident procedures, continuity) to owners and evidence.
Control Baseline and Annual Testing
Hold the SP 800-53 controls for each system with the test result at least annually and the remediation actions opened for deficiencies.
Incident and Breach Log
Record incidents reported to the federal incident center and start the seven-day major-incident and 30-day breach notification clocks with the notices sent.
Directive Compliance
Track each binding operational directive and emergency directive, its required actions, due dates and the evidence returned to CISA.
IG Evaluation and Annual Report
Assemble the representative system subset, metrics and narrative for the section 3555 evaluation and the section 3554(c) annual report in one workspace.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
FedRAMP Rev5 is the legacy FedRAMP certification type: NIST SP 800-53 Rev. 5 baselines, 3PAO assessment and agency authorization for cloud services used by U.S. agencies.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
NIST SP 800-171 Rev. 2: 110 CUI security requirements in 14 families, withdrawn by NIST on May 14, 2024 but still the edition DFARS 252.204-7012 and CMMC Level 2 cite.
Frequently Asked Questions For FISMA (Federal Information Security Modernization Act)
The head of each agency (44 U.S.C. 3554(a)), who delegates compliance to the Chief Information Officer; the CIO designates a senior agency information security officer whose primary duty is security. OMB's Director oversees policy (section 3553(a)) and the Secretary of Homeland Security administers implementation for civilian systems (section 3553(b)).
Indirectly. Section 3554(a) covers information collected or maintained on behalf of an agency and systems operated by a contractor or other organization on an agency's behalf, so the agency must ensure those systems meet the same standards. Cloud services reach agencies through FedRAMP, which sits inside FISMA.
A compulsory direction to an agency to safeguard federal information and systems from a known or reasonably suspected threat, vulnerability or risk, issued by DHS consistent with OMB policy (section 3552(b)(1)). CISA publishes them, for example BOD 26-04 on prioritizing security updates. They do not apply to national security, DoD or intelligence community systems.
Section 3554(b)(7) requires notice to the designated committees of Congress not later than seven days after there is a reasonable basis to conclude that a major incident has occurred, with updates as more is learned. Section 2(d) of the Act separately requires breach notification to Congress within 30 days of discovery and notice to affected individuals without unreasonable delay.
Section 3554 requires compliance with the information security standards promulgated under 40 U.S.C. 11331, under which the Secretary of Commerce makes NIST standards compulsory and binding. In practice that means FIPS 199 and FIPS 200 and the NIST SP 800-53 control baselines, applied through the Risk Management Framework.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.