Shawn P. McCarthy | FISMA II − It's not exactly what it sounds like
Connecting state and local government leaders
Commentary: The effort to extend the effectiveness of FISMA - by helping agencies choose the right people to improve the overall security of their systems - has some confused about its name.
They mean the same thing, although, unfortunately, the name itself is a bit confusing. The original (and still current) Federal Information Systems Management Act of 2002 was a major piece of legislation that continues to have an impact on the way agencies handle their security audits and reporting. Among other things, FISMA sets mandatory processes to be followed by all government IT systems, whether they are operated by the government or by a federal contractor.
FISMA II, on the other hand, is not an act of Congress, nor is it an official update of FISMA. Instead, it's an informal term for a federal credentialing program coordinated by the National Institute of Standards and Technologies' Computer Security Division. Think of it as an effort to build a set of qualifications that can be used to establish the credentials for the people who provide security assessments.
Adding to the confusion: There have been bills proposed in Congress that include updates to security rules. Some of those have unofficially been referred to as FISMA II while under discussion. However, no legislation has been passed, nor can any bill be considered a serious contender, as a replacement for the famed FISMA.
But regardless of the confusion, it's not fair to call FISMA Phase II a misnomer. It's a genuine effort to extend the effectiveness of FISMA by helping federal agencies choose the right people to conduct their security audits and improve the overall security of their systems.
FISMA Phase II is an increasingly formalized accreditation process for FISMA compliance assessment teams. Requiring such teams to show that they have a full understanding of and competence in NIST's Risk Management Framework should assure better long-term compliance with FISMA.
In the past few years, many agencies have moved toward a risk-management approach to security, making sure they address their most risky and vulnerable issues first. Agencies typically hire contractors to help them certify and accredit their systems to meet FISMA requirements. It is important that they be confident that the contractors they hire can assure the NIST framework is being met.
According to Ron Ross, senior computer scientist, "FISMA is really a three-legged stool." He said it consists of the legislation, the associated standards and guidelines developed by NIST with help from agencies, and the monitoring and reporting process that leads toward assessment and improvement.
To make sure assessment teams are monitoring the right things, NIST is developing training programs, testing programs and establishing ways for such teams (whether they are government employees or commercial service providers) a way to demonstrate competence. They also want to be sure monitoring teams conduct on-site inspections, are capable of doing product-level evaluations, and that they understand things such as the Security Content Automation Protocol, the Federal Desktop Core Configuration initiative and more.
The idea for such credentialing has been around since at least 2006, and last fall NIST launched a formal project to develop security credentials based on its FISMA security and risk management guidance.
One criticism of FISMA is that it encourages and certifies compliance, but that doesn't necessarily mean improved security.
"We hear that a lot," said Ross. But he stressed that certification and compliance are a major step toward more secure systems. "It's our hope that we get to the point where compliance equals security." Essentially that would mean measuring the right set of things at the right time to assure very tight security under the NIST risk management framework for IT systems.
Next on the organization's agenda: a joint project with the Director of National Intelligence and Defense Department to transition to a single set of standards and guidelines for security certification and accreditation.