TLDR;
This video provides an overview of the Federal Information Security Modernization Act (FISMA), its key components, drivers, and its impact on security compliance and regulation within the federal government. It covers the initial release of FISMA in 2002, its update in 2014, and the key expectations for agencies regarding risk management, security controls, and compliance reporting. The video also touches on the refinement of reporting requirements, enhanced focus on cyber breach notification, and the role of the Department of Homeland Security in pushing out cybersecurity best practices.
- FISMA's initial focus was on protecting government systems and data, including those managed by contractors.
- The 2014 update emphasized cyber breach notification and the role of DHS in cybersecurity.
- Key expectations include risk management, selecting security controls, and compliance reporting to Congress.
Introduction to FISMA [0:01]
Mike Grim from Optic Cyber Solutions introduces the Federal Information Security Modernization Act (FISMA), highlighting its key components, drivers, and its influence on security compliance and regulation within the federal government. FISMA was initially released as the Federal Information Security Management Act and later updated in 2014. The initial release in 2002, as part of the E-Government Act, had key areas for the instantiation of the law.
Key Drivers of FISMA (2002) [0:31]
The initial drivers for FISMA included a strong protection mandate to secure government systems and data, whether government-owned or managed by contractors. It was also a response to the increasing digitization of government operations, requiring robust security protections for IT systems, similar to physical security measures. Economic and national security concerns, along with a focus on cybersecurity, particularly the confidentiality, integrity, and availability of government systems and data, were also significant drivers.
Key Drivers of FISMA (2002) Continued [1:56]
The key drivers of FISMA's initial release in 2002 primarily focused on the need for information security and the systems processing that information, including sensitive government and citizen data like Social Security numbers. There was an increasing dependence on Information Technology, with new needs for storage and evolving paradigms from mainframes to client-server technologies. The rising tide of cybersecurity threats, including hacking, necessitated standardized security practices, as different agencies and government parts had inconsistent security implementations. Compliance and accountability were also crucial, as FISMA sought to address inconsistencies in compliance checks, auditing, and accountability within organizations.
Key Expectations for FISMA [3:11]
Key expectations for FISMA include risk management, requiring agencies to conduct regular risk assessments to determine the necessary security level for their systems. Agencies must select security controls as defined in FIPS 200, based on the information type processed by the system (low, moderate, or high). These controls are operationalized via the Risk Management Framework (RMF), a seven-step process involving system categorization, security control implementation from NIST 800-53, and compliance reporting through annual assessments and audits submitted to Congress to ensure a baseline security level is maintained.
FISMA Modernization Act (2014) [4:13]
In 2014, FISMA was updated with the Modernization Act, adding to the 2002 act by refining reporting requirements and enhancing the focus on cyber breach notification. The Department of Homeland Security (DHS) was given a defined leadership role in pushing out information security best practices for federal systems, which is seen today with CISA's cybersecurity guidance, including zero trust initiatives. The development of Binding Operational Directives, requiring critical systems to be patched, also became prominent. Reporting requirements shifted to focus more on threats, security incidents, and compliance with security requirements, with executive branch civilian agencies required to notify and consult with US-CERT regarding security incidents.
Overall Focus of FISMA [5:23]
The overall focus of FISMA is to provide more visibility into the security posture across government agencies, enabling the government to ingest and use that information to ensure an uplift or at least notification of critical threats. This holistic approach to cybersecurity from a government perspective aims to ensure a comprehensive defense against cyber threats.
Resources and Contact Information [5:48]
Optic Cyber Solutions offers various resources, including a risk management framework overview that walks through the seven steps of the RMF. The video lists resources such as the PDF version of RMF NIST 800-37, the security controls catalog 800-53, and the RMF overview website provided by NIST. Optic Cyber Solutions helps organizations identify and address their blind spots through assessment, implementation, and advising services. For more information, contact [email protected] or visit opticcyber.com.
