Federal Information Security Management Act of 2002

Enacted in 2002, the Federal Information Security Management Act (FISMA), was passed to support the E-Government Act of 2002. Without information security, it is impossible for government to deliver reliable services through electronic means. The advent of Internet delivery and cloud computing immensely complicates the security problem.

Nevertheless, there may well be solutions for these new environments, if proper perspective is kept. In any security context, there is acceptance of responsibility, as well as acceptance of risk. An approach to security purely in the network has long been endpoint security, leaving the network encrypted. When the servers are outsourced, it may be that endpoint encryption will remain under control of the owning agency, but audit is the main tool for checking on the server operator.

Framework

Technical definitions and framework are in Federal Information Processing Standard (FIPS) FIPS PUB 199, "Standards for the Security Categorization of Federal Information and Information Systems". While the detailed guidance is in additional guidance, FIPS 199 interprets FISMA as having three dimensions of security categorization:

• Confidentiality
• Integrity
• Availability

and matrixes these against potential impact characterized as low, medium and high:

Factor
	Low	Medium	High
Confidentiality	row 1, cell 2	row 1, cell 3
Integrity	row 2, cell 2	row 2, cell 3
Availability	row 2, cell 2	row 2, cell 3

Solution architecture

For designing FISMA implementations, the primary reference is NIST Special Publication 800-53, Revision 3, "Recommended Security Controls for Federal Information Systems and Organizations"

Status

On May 19, 2009, the House took testimony at the required 60-day reporting interval after start of FISMA implementation. Vivek Kundra, the Federal Chief Information Officer, summarized the overall status: "recent successful breaches at the Federal Aviation Administration and at the vendor that hosts USAjobs.gov demonstrate that the current state of information security at Federal agencies is not what the American people have the right to expect. The Federal Information Security Management Act (FISMA) has been in place for 7 years. It has raised the level of awareness in the agencies and in the country at large, but we are not where we need to be." OMB identified the following key issues:

• The performance information currently collected under FISMA does not fully reflect the security posture of Federal agencies;
• The processes used to collect the information are cumbersome, labor‐intensive, and take time away from meaningful analysis, and;
• The Federal community is focused on compliance, not outcomes

At the same hearing, Margaret Graves, CIO of the U.S Department of Homeland Security, spoke more specifically about implementation in a real agency.

Criticism

FISMA has been criticized, by legislators and legislative agencies, for being too dependent on manual paper procedures and not enough on specific enforcement technologies and procedures.

In April 2009, Senator Thomas Carper (D-Delaware) introduced two pieces of legislation to force more actual compliance and less paper reporting of hypothetical compliance. Hearings also were held in May by Subcommittee on Government Management, Organization and Procurement of the U.S. House Committee on Oversight and Government Reform.