FISMA: US Federal Information Security Law Explained

The Federal Information Security Modernization Act of 2014 (FISMA) is the US law that governs information security in federal agencies. It requires each agency to protect its information and systems, including those run by contractors and other organisations on its behalf. For IT companies, FISMA matters when you build, host or operate a system for a federal agency: the agency’s obligations flow to you through the contract.

What is FISMA?

FISMA assigns responsibilities:

NIST standards turn FISMA into practice: FIPS 199 (security categorisation), FIPS 200 (minimum security requirements), SP 800-53 (controls), SP 800-37 (Risk Management Framework) and SP 800-53A (assessments).

History and why it was introduced

FISMA was introduced because federal agencies had inconsistent, often weak security, and there was no consistent framework to hold them accountable. The 2014 update modernised it to focus on continuous monitoring and faster incident response.

Main objectives:

1. A comprehensive framework for securing federal information and systems.
2. Risk-based, cost-effective security.
3. Accountability through annual reporting and independent evaluation.
4. Coordinated incident response across government.

Who needs FISMA compliance?

Is FISMA mandatory?

Yes, for federal agencies and for information systems operated on their behalf. There are no direct fines for contractors under FISMA. Consequences for contractors are contractual: systems can’t be authorised, contracts can be terminated, and failures can affect future awards. Agencies face oversight consequences through OMB, Congress and Inspector General reports.

Key requirements

Agency security programme

• Periodic risk assessments.
• Policies and procedures based on risk.
• Subordinate plans for networks, facilities and systems.
• Security awareness training for staff and contractors.
• Periodic testing and evaluation of controls, at least annually.
• Remediation processes for deficiencies.
• Incident detection, reporting and response.
• Continuity of operations plans.

System-level requirements (through the NIST RMF)

Incident reporting

Agencies report incidents to CISA under its federal incident notification guidelines, and must notify Congress of major incidents within seven days of determining that a major incident has occurred. Contracts usually require contractors to report incidents to the agency within short timeframes, often one hour.

Annual reporting

Agencies report metrics to OMB and CISA, and Inspectors General carry out an annual independent evaluation using metrics aligned with the NIST CSF functions. OMB summarises results in an annual report to Congress.

How contractors meet FISMA requirements

1. Read the contract for FISMA, security and incident reporting clauses, and agency-specific policies.
2. Confirm the system boundary and impact level with the agency.
3. Implement the SP 800-53 baseline for that level, tailored with the agency.
4. Write the system security plan and supporting documents.
5. Support the assessment by the agency’s assessor or an independent assessor.
6. Help the agency obtain an ATO.
7. Run continuous monitoring: vulnerability scanning, configuration management, POA&M updates and periodic reporting.
8. Screen and train personnel with access, as the agency requires.
9. Report incidents within contract timeframes.

Documentation

• System security plan (and privacy plan where applicable)
• Policies and procedures for each control family
• Security categorisation (FIPS 199)
• Security assessment plan and report
• Plan of action and milestones (POA&M)
• Authorisation package and ATO letter
• Contingency plan and test results
• Incident response plan and test results
• Configuration management plan
• Continuous monitoring strategy and reports
• Interconnection security agreements with other systems

Audits and assessments

• Security control assessments before authorisation and periodically after.
• Inspector General evaluations each year, at agency level.
• GAO audits of agency information security.
• No FISMA certification. A system receives an ATO from its agency; there is no “FISMA certified” status for a company.

Cost

Benefits

• Access to federal contracts.
• Mature, well-documented security.
• Reusable work for FedRAMP, GovRAMP and state contracts.

Risks of non-compliance

• No ATO, so the system can’t go live.
• Contract termination or poor past performance ratings.
• Security incidents with national impact and public scrutiny.

Common mistakes

• Calling a product “FISMA certified”. Systems receive ATOs; companies are not certified.
• Unclear boundaries between contractor corporate systems and federal systems.
• Treating the ATO as the finish line instead of starting continuous monitoring.
• Stale POA&Ms.
• Missing contract incident timelines.

Challenges for IT companies

• Heavy documentation for each system.
• Different interpretations across agencies.
• Integrating agile delivery with authorisation processes (some agencies use continuous or ongoing ATO approaches).
• Supply chain and software attestation requirements.

Best practices

• Agree the authorisation boundary and impact level early.
• Use FedRAMP-authorised cloud services to inherit controls.
• Automate continuous monitoring and use OSCAL where agencies accept it.
• Keep POA&Ms current and realistic.
• Build relationships with the agency’s ISSO and authorising official.

Tools that help

How FISMA relates to other frameworks

Real-world examples

• OPM breach (2015). The theft of background investigation records for about 21.5 million people from the Office of Personnel Management led to scrutiny of agency FISMA compliance and system authorisations.
• Annual FISMA reports. OMB’s yearly report to Congress summarises agency incidents and Inspector General ratings.
• Illustrative scenario, not a real company: an IT services firm wins a contract to build a case management system for a federal agency. It agrees a moderate impact level, builds on a FedRAMP-authorised cloud, writes the SSP during development, and supports the agency’s assessment to obtain an ATO before launch.

Frequently asked questions

Does FISMA apply to private companies? Only when they operate information systems on behalf of a federal agency, through their contracts.

What is an ATO? An authority to operate: a formal decision by an agency official to accept the risk of running a system.

Is FISMA the same as FedRAMP? No. FISMA is the law for federal agencies. FedRAMP is the programme that applies its requirements to cloud services used by agencies.

Can a company be FISMA certified? No. Systems are authorised by agencies.

What standards does FISMA use? NIST standards, mainly FIPS 199, FIPS 200, SP 800-53 and the Risk Management Framework (SP 800-37).

How quickly must incidents be reported? Agencies follow CISA’s incident notification guidelines; contracts usually set short timeframes for contractors, often one hour.

Next steps

• Read your contract’s security and incident clauses.
• Confirm the system boundary and impact level with the agency.
• Start the system security plan alongside development.
• Plan continuous monitoring before go-live.