Adopting a holistic approach to FISMA compliance

Considered onerous by some, the Federal Information Security Management Act (FISMA) is multi-faceted program that reaches far into an organization. To optimize compliance and minimize duplication of effort, agency security teams are well advised to take a holistic approach and implement an enterprisewide data security solution.

After all, FISMA was designed (in theory) to promote the development of security standards and guidelines. And while one industry complaint about FISMA is that it relies too heavily on boiler-plate reporting, the 2014 FISMA updates indicate that the government is charging agencies to institute a more dynamic security program -- one that is continually monitored and more responsive to the needs of the organization as a whole.

So what is a holistic approach to FISMA compliance? Let’s start with what it’s not.

Currently, many organizations deploy security programs in response to compliance requirements, pending audits or the latest new technology. As a result, security program can become disjointed. Members of the IT team are constantly in ‘react’ mode; fighting fires and troubleshooting, they can be too overwhelmed to uncover problems before they occur.

By contrast, a holistic approach considers the organization from a ‘30,000 foot view.’ Here, the security team examines the entire IT infrastructure to determine how best to assign controls and centralize tasks. What business areas are at greater risk should there be an attack? How can reporting be centralized? In what areas can redundancy be reduced? How can platforms be standardized? To explore each of these areas, cross-functional management teams must be involved.

Forward-thinking organizations should also develop a crosswalk to align all compliance requirements -- not just those of FISMA. By doing so, security teams can ‘test once and report many,’ thereby optimizing the resources needed to meet multiple compliance requirements.

A holistic approach to FISMA compliance involves a significant up-front commitment. Policies, procedures and technology from across the organization must be evaluated for efficacy. More costly enterprise solutions may be called for, and staff is often required to make adjustments in how it currently manages data security.

This approach requires a significant investment of time, people and money in the beginning. Of course, the path of least resistance is to keep things as they are and adopt singular fixes siloed around a compliance requirement or a particular business line. But ultimately, a disparate set of controls becomes hard to manage and soon begins to underperform. This scenario weighs down the entire organization and exposes it to greater risk in addition to costing much more in the long run.

In comparison, a more centralized but holistic approach typically lowers the total cost of ownership. System changes become more efficient, upgrades are more consistent and standard operating procedures are portable.

As an added bonus, compliance is easier to manage. Audits tend to go more smoothly; they often result in fewer findings and are less disruptive, freeing the IT team to focus on innovation, rather than scrambling to keep up with FISMA regulations.

Standardizing platforms and processes

Standardized platforms throughout the organization significantly increase efficiencies in a security program. The benefits of standardization apply not only to security tools, but to operating systems, utilities, applications and workstations as well. For example, a standardized database or Windows server configuration requires significantly fewer man-hours to monitor for anomalies, disseminate security fixes and generate FISMA compliance reports.

But standardization needs to extend beyond hardware and software. One of the biggest hurdles in responding to compliance is ad hoc policies and procedures that are administered inconsistently throughout the agency. If each department deploys security controls and manages artifacts in its own way, FISMA compliance becomes even more taxing than it already is.

Standard policies and procedures help to minimize overlapping tasks, increase reporting accuracy and more readily address gaps. Testing is easier as well. For example, if a standard procedure and system is in place for submitting change or help desk tickets, a single sample can be tested to determine whether or not the entire ticketing system is operating as it should.

By creating standards for change and patch management, handling artifacts in a consistent way, regulating system monitoring and deploying a centralized content management system, FISMA compliance -- and reporting -- becomes significantly less burdensome. But more important, the entire security program becomes more efficient at doing what it’s supposed to do -- that is, protecting the agency’s data.