FISMA Compliance Software Solutions
The Federal Information Security Management Act (FISMA) is a US law that imposes information security standards and requirements on all US federal agencies. It was amended in 2014 by the Federal Information Security Modernization Act, which aimed to enable the federal government to better respond to cyber attacks on its departments and agencies.
Guidance for complying with FISMA IT requirements is provided by the National Institute of Standards and Technology (NIST), which lays out standards for categorizing information, recommendations on the types of information and systems to be included in each category, and minimum information security requirements.
Who needs to comply with FISMA?
The objective of FISMA is to ensure the effectiveness of information security controls over information resources that support federal operations and assets by implementing cost-effective security solutions based on the estimated level of cybersecurity risk.
In the beginning, only federal agencies had to comply with FISMA reporting and security requirements. Now, state agencies that manage federal programs, contractors who work with federal agencies, and private sector companies that work with federal agencies must also comply with FISMA.
FISMA compliance requirements
FISMA requires federal organizations and their contractors to:
Inventory information systems
FISMA requires all federal agencies to create and maintain an inventory of information systems that they operate or that are under their control. This inventory must identify the interfaces between all systems within the agency’s network.
Prepare a system security plan
All federal agencies have to develop a security plan and update it regularly. These plans have to comply with NIST SP 800-18, “Guide for Developing Security Plans for Federal Information Systems.”
Get certified and accredited
Each federal agency has to conduct periodic security reviews to show that they can manage their systems to be FISMA compliant. This is accomplished through a four-phase process: initiation and planning, certification, accreditation, and continuous monitoring.
Federal organizations and their contractors have to validate their security controls and determine if any additional controls are needed to protect critical information. The resulting set of security controls establishes a level of security due diligence for the federal agency and its contractors.
Each federal agency has to follow FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems.” This document provides information on how to categorize risks as well as requirements to ensure the highest level of security. Another helpful guide is NIST SP 800-60, “Guide for Mapping Types of Information and Information Systems to Security Categories.”
Evaluate security controls
Security controls include access controls, incident response, configuration management, and identification and authentication. All major security controls for complying with FISMA are defined in NIST SP 800-53 [PDF]. Also, you should explore the Federal Information Processing Standard (FIPS) 200, “Minimum Security Requirements for Federal Information and Information Systems,” to learn more about minimum security requirements.
The NIST Risk Management Framework is an essential guide to FISMA compliance, as it offers a risk-based approach to selecting, implementing, and monitoring security controls.
Ensure continuous monitoring
All accredited systems used within a federal agency and by its contractors have to be monitored. Continuous monitoring is required to efficiently manage an organization’s security and eliminate vulnerabilities.
Meeting FISMA security controls with Ekran System
Covering NIST 800-53 security controls is essential for FISMA compliance.
Ekran System offers a set of features to improve access controls, strengthen identification and authentication mechanisms, cover the audit and accountability control family of requirements, and ensure a robust incident response.
|Control family||Requirements||Ekran System features|
Audit and Accountability
Identification and Authentication
Explore more capabilities of Ekran System, which covers most NIST 800-53 requirements.
Meeting FISMA continuous monitoring requirements with Ekran System
Ekran System provides the ability to monitor insider activity, detect abnormal behavior, and respond to incidents. In particular, Ekran System:
- Allows for online and offline monitoring of both in-house and remote users
- Collects monitoring data in secure storage if the connection is down
- Offers Protected Mode to prevent actions to block monitoring
- Records each user session in searchable audio and video formats
- Generates detailed, easy-to-analyze reports
Meeting FISMA requirements is easier with Ekran System. Plus, Ekran helps you comply with the requirements of other industry standards and regulations, including NIST 800-53, SWIFT CSP, HIPAA, the GDPR, and PCI DSS.