NIST Logo and ITL Banner Link to the NIST Homepage Link to the ITL Homepage Link to the NIST Homepage
Search CSRC:

Detailed Overview


The E-Government Act (Public Law 107-347) passed by the 107th Congress and signed into law by the President in December 2002 recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA) requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

An effective information security program should include:

  • Periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the organization
  • Policies and procedures that are based on risk assessments, cost-effectively reduce information security risks to an acceptable level, and ensure that information security is addressed throughout the life cycle of each organizational information system
  • Subordinate plans for providing adequate information security for networks, facilities, information systems, or groups of information systems, as appropriate
  • Security awareness training to inform personnel (including contractors and other users of information systems that support the operations and assets of the organization) of the information security risks associated with their activities and their responsibilities in complying with organizational policies and procedures designed to reduce these risks
  • Periodic testing and evaluation of the effectiveness of information security policies, procedures, practices, and security controls to be performed with a frequency depending on risk, but no less than annually
  • A process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, and practices of the organization
  • Procedures for detecting, reporting, and responding to security incidents
  • Plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the organization.

FISMA, along with the Paperwork Reduction Act of 1995 and the Information Technology Management Reform Act of 1996 (Clinger-Cohen Act), explicitly emphasizes a risk-based policy for cost-effective security. In support of and reinforcing this legislation, the Office of Management and Budget (OMB) through Circular A-130, Appendix III, Security of Federal Automated Information Resources, requires executive agencies within the federal government to:

  • Plan for security
  • Ensure that appropriate officials are assigned security responsibility
  • Periodically review the security controls in their information systems
  • Authorize system processing prior to operations and, periodically, thereafter

These management responsibilities presume that responsible agency officials understand the risks and other factors that could adversely affect their missions. Moreover, these officials must understand the current status of their security programs and the security controls planned or in place to protect their information and information systems in order to make informed judgments and investments that appropriately mitigate risk to an acceptable level. The ultimate objective is to conduct the day-to-day operations of the agency and to accomplish the agency's stated missions with adequate security, or security commensurate with risk, including the magnitude of harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. As a key element of the FISMA Implementation Project, NIST also developed an integrated Risk Management Framework which effectively brings together all of the FISMA-related security standards and guidance to promote the development of comprehensive and balanced information security programs by agencies.

Back to Top

Project Phases

Phase I: Standards and Guidelines Development (2003-2012)

The first phase of the FISMA Implementation Project focuses on the development and updating of the security standards and guidance required to effectively implement the provisions of the legislation. The implementation of the NIST standards and guidance will help agencies create and maintain robust information security programs and effectively manage risk to agency operations, agency assets, and individuals.

Back to Top

Phase II: Implementation and Assessment Aids (2007-2012)

The second phase of the FISMA Implementation Project is focused on providing information system implementation and assessment reference materials for building common understanding in applying the NIST suite of publications supporting the Risk Management Framework (RMF).

The reference materials are intended to aid organizations in developing approaches for applying NIST publications in implementing appropriate management, operational, and technical security controls in federal information systems. The security assessment reference materials are intended to promote common approaches for assessing the extent to which the security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system, including information technology products and services used in security control implementation.

This phase of the FISMA Implementation Project includes the following initiatives:

(i) Training Initiative: for development of training courses, NIST publications Quick Start Guides (QSG’s), and Frequently Asked Questions (FAQ’s) for establishing common understanding of the NIST standards and guidelines supporting the Risk Management Framework;

(ii) Support Tools Initiative: for defining criteria for common reference programs, materials, checklists, (i.e NVD, SCAP, etc.), technical guides, automated tools and techniques supporting implementation and assessment of SP 800-53-based security controls;

(iii) Product and Services Assurance Initiative: for defining minimum criteria and guidelines for security assurances (to include test results from SCAP tools and configuration checklists, etc. where applicable) in products and services supporting implementation and assessment of SP 800-53-based security controls in information system operational environments;

(iv) ISO Harmonization Initiative: for identifying common relationships and mappings of FISMA standards, guidelines and requirements with: (i) ISO/IEC 27000 series information security management standards; and (ii) ISO/IEC 9000 and 17000 series quality management, and laboratory testing, inspection and accreditation standards. This harmonization is important for minimizing duplication of effort for organizations that must demonstrate compliance to both FISMA and ISO requirements; and

(v) Organizational Assessment Capability Criteria Initiative: drawing upon material from the above initiatives, define minimum capability and proficiency criteria for public and private sector organizations providing security assessment services of information systems for federal agencies.

= = = = = = = = = = = = = = = = =

Organizations can draw upon these initiatives to help demonstrate common capabilities in the application of the NIST security standards and guidelines. Developing a network of organizations with common capabilities in the provision of the Risk Management Framework (implementation and assessment services) will give federal agencies greater confidence in the acquisition and use of such services.

Back to Top