FISMA Compliance Software Solutions


The Federal Information Security Management Act (FISMA) is a US law that imposes information security standards and requirements on all US federal agencies. It was amended in 2014 by the Federal Information Security Modernization Act, which aimed to enable the federal government to better respond to cyber attacks on its departments and agencies.


Guidance for complying with FISMA IT requirements is provided by the National Institute of Standards and Technology (NIST), which lays out standards for categorizing information, recommendations on the types of information and systems to be included in each category, and minimum information security requirements.


Who needs to comply with FISMA?

The objective of FISMA is to ensure the effectiveness of information security controls over information resources that support federal operations and assets by implementing cost-effective security solutions based on the estimated level of cybersecurity risk.


In the beginning, only federal agencies had to comply with FISMA reporting and security requirements. Now, state agencies that manage federal programs, contractors who work with federal agencies, and private sector companies that work with federal agencies must also comply with FISMA.


FISMA compliance requirements


FISMA requirements for federal organizations and their contractors:


Inventory information systems


FISMA requires all federal agencies to create and maintain an inventory of information systems that they operate or that are under their control. This inventory must identify the interfaces between all systems within the agency’s network.


Prepare a system security plan


All federal agencies have to develop a security plan and update it regularly. These plans have to comply with NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems.


Get certified and accredited


Each federal agency has to conduct periodic security reviews to show that they can manage their systems to be FISMA compliant. This is accomplished through a four-phase process: initiation and planning, certification, accreditation, and continuous monitoring.


Assess risks


Federal organizations and their contractors have to validate their security controls and determine if any additional controls are needed to protect critical information. The resulting set of security controls establishes a level of security due diligence for the federal agency and its contractors.


Learn more about Third-Party Vendor Security Monitoring


Categorize risks


Each federal agency has to follow FIPS 199 Standards for Security Categorization of Federal Information and Information Systems. This document provides information on how to categorize risks as well as requirements to ensure the highest level of security. Another helpful guide is NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories.


Evaluate security controls


Security controls include access controls, incident response, configuration management, and identification and authentication. All major security controls for complying with FISMA are defined in NIST SP 800-53 [PDF]. You should also explore the Federal Information Processing Standard (FIPS) 200 Minimum Security Requirements for Federal Information and Information Systems to learn more about minimum security requirements.


The NIST Risk Management Framework is an essential guide to FISMA compliance, as it offers a risk-based approach to selecting, implementing, and monitoring security controls.


Ensure continuous monitoring


All accredited systems used within a federal agency and by its contractors have to be monitored. Continuous monitoring is required to efficiently manage an organization’s security and eliminate vulnerabilities.


Meeting FISMA security controls with Ekran System


Covering NIST 800-53 security controls is essential for FISMA compliance.


Ekran System offers a set of features to improve access controls, strengthen identification and authentication mechanisms, cover the audit and accountability control family of requirements, and ensure a robust incident response.


Control family Requirements Ekran System features

Access Control

  • Account management (AC-2)
  • Access enforcement (AC-3)
  • System use notification (AC-8)

Audit and Accountability

  • Audit events (AU-2)
  • Content of audit records (AU-3)
  • Time stamps (AU-8)
  • Session audit (AU-14)
  • Audit review, analysis, and reporting (AU-6)
  • Protection of audit information (AU-9)

Identification and Authentication

  • Identification and authorization for organizational users (IA-2)
  • Identification and authorization for non-organizational users (IA-8)

Incident Response

  • Incident handling (IR-4)
  • Incident monitoring (IR-5)


Explore more capabilities of Ekran System, which covers most NIST 800-53 requirements.


Using Ekran System to meet FISMA continuous monitoring requirements


Ekran System provides the capability to monitor insider activity, detect abnormal behavior, and respond to incidents. In particular, Ekran System:


  • Allows for online and offline monitoring of both in-house and remote users
  • Collects monitoring data in secure storage if the connection is down
  • Offers Protected mode to prevent monitoring being stopped
  • Records each user session in searchable audio and video formats
  • Generates detailed, easy-to-analyze reports



Meeting FISMA requirements is easier with Ekran System. Plus, Ekran helps you comply with the requirements of other industry standards and regulations, including NIST 800-53, SWIFT CSP, HIPAA, the GDPR, and PCI DSS.