What category of obligation this is
The Federal Information Security Management Act (FISMA 2002) is part of the E-Government Act. FISMA 2002 required each federal agency to develop, document, and implement an agency-wide information security program. The program covers information and systems that support the operations and assets of the agency. The program also covers information and systems that another agency, a contractor, or another source provides or manages.
The Federal Information Security Modernization Act of 2014 amends FISMA 2002. The NIST background page describes the modernization themes. The themes are fewer reports overall, stronger use of continuous monitoring, and reports that focus more on issues caused by security incidents. FISMA 2014 also required OMB to amend Circular A-130.
Who it frames
FISMA frames federal agencies, and people who use or operate a federal information system. NIST quotes the FISMA 2002 definition of a federal information system. A federal information system is an information system used or operated by an executive agency or by a contractor of an executive agency. It is also an information system used or operated by another organization on behalf of an executive agency.
A system that a contractor runs on behalf of an agency can still be a federal information system. That lane is not the same sentence as CUI on a nonfederal system. Federal FISMA obligations do not automatically cover every state or local agency. A city or state program is not auto-FISMA.
Risk-based protections
The NIST background page states that federal agencies need information security protections commensurate with the risk and magnitude of harm. The harm comes from unauthorized access, use, disclosure, disruption, modification, or destruction of agency information. The same applies to information systems used or operated by an agency, a contractor, or another organization on behalf of an agency.
OMB Circular A-130, as summarized on that page, sets requirements for executive agencies. Executive agencies must plan for security and assign security responsibility to appropriate officials. They must periodically review security controls. They must authorize the system to process information before operations and periodically after that. Those themes are not an authorization worksheet.
The NIST suite is not a FISMA compliance checklist
NIST states this directly. The suite of NIST information security risk management standards and guidelines is not a "FISMA Compliance checklist." Agencies, contractors, and other sources that use or operate a federal information system use that suite to develop and implement a risk-based approach. NIST describes compliance with applicable laws, regulations, executive orders, and directives as a byproduct of a robust risk-based program.
A review of SP 800-53, or of SP 800-171, does not issue a FISMA result. The publications support risk management. They are not a seal.
RMF is where agencies often operationalize
The NIST Risk Management Framework (RMF) is the flexible 7-step process that links to the NIST suite in support of FISMA programs. The steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.
FISMA and the RMF process are not the same thing.
Three lanes that sound federal
FISMA covers federal agency information security management, including systems operated on behalf of an agency. FedRAMP is the standardized, reusable cloud product and service assessment and Authorization program for federal agency adoption. CMMC is the DoD/DoW contractor assessment program for FCI and CUI in the Defense Industrial Base.
SP 800-171 sits next to CMMC. It is NIST guidance for the protection of CUI in nonfederal systems. That adjacency is not "FISMA done."
CSF is not automatic FISMA
NIST CSF 2.0 is a risk-management framework usable by government agencies and organizations of any size. The framework itself is not a law, a certification, or a blanket FISMA requirement. CISA Cross-Sector Cybersecurity Performance Goals stay voluntary prioritized practices. They are not a universal legal mandate for public agencies.
Use of CSF 2.0 does not finish a FISMA program.
Rewrite the one-line claim
The claim that an organization is "FISMA, FedRAMP, and CMMC compliant" is not accurate. The lane that matches the system replaces that claim. An agency federal information system is a FISMA question. A cloud offering on a Marketplace Authorization path is a FedRAMP question. The agency still has system duties for that offering. A Defense Industrial Base contractor environment that holds CUI is a CMMC and SP 800-171 question, not a FISMA seal.
At work, the team privately sorts one system that it touches into one lane. The lanes are agency federal system, cloud offering Authorization, or contractor CUI. The team escalates to the authorizing official or the contracts owner.
FISMA is not FedRAMP, and not CMMC
| Lane | What it is |
|---|---|
| FISMA | Statutory backdrop for federal agency information security management, for federal information and systems. That backdrop includes operation on behalf of an agency. |
| FedRAMP | Standardized, reusable cloud product and service assessments and Authorizations for federal agency adoption. The customer still configures. |
| CMMC | DoD/DoW contractor assessment program for FCI and CUI protection in the Defense Industrial Base. |
Common misconceptions
FISMA, FedRAMP, and CMMC are the same federal badge.
FISMA is the federal agency information security program backdrop. FedRAMP is cloud offering Authorization reuse. CMMC is the contractor assessment program for FCI and CUI. These are three lanes.
We implemented CSF 2.0, so we are FISMA done.
CSF 2.0 is a framework. It is not a law, a certification, or a blanket FISMA requirement. CPGs remain voluntary prioritized practices.
A state or city agency is automatically FISMA.
FISMA frames federal agencies and federal information systems. It does not automatically cover every state or local agency.
A FedRAMP Authorized SaaS means the agency finished FISMA and has no remaining system duty.
A cloud Authorization path is the FedRAMP lane. The agency still owns the federal information system. That ownership also covers how that offering is configured and used.
A review of SP 800-53, or of SP 800-171, means the system is FISMA certified.
NIST states that the risk-management suite is not a FISMA compliance checklist. SP 800-171 is the CUI-on-nonfederal publication next to CMMC, not a FISMA seal.
Compliance is the goal of a FISMA program.
NIST describes compliance as a byproduct of a risk-based security program. FISMA puts the weight on risk management.
Sort three synthetic cases
| Case | Lane | Note |
|---|---|---|
| An executive agency system, and also one that a contractor operates on behalf of the agency. | FISMA | Federal agency information security management. Not a state or local program by default. |
| A cloud product or service on a Marketplace Authorization path that an agency adopts. | FedRAMP | Reusable cloud Authorization. The agency still configures. |
| A Defense Industrial Base contractor environment that safeguards CUI on nonfederal systems. | CMMC | Contractor assessment program. SP 800-171 is the adjacent CUI publication, not FISMA done. |
CHECK THE CATEGORY
Which statement describes the FISMA statutory lane accurately?
Glossary and nearby pages
- Public sector industry path
- FedRAMP explainer (cloud Authorization, different lane)
- CMMC explainer (contractor assessment program)
- SP 800-171 explainer (CUI on nonfederal systems, not FISMA done)
- NIST CSF 2.0 (related path cite, not automatic FISMA)
- CISA Cross-Sector CPGs explainer (voluntary goals, not FISMA)
- SP 800-37 Risk Management Framework explainer (process literacy, separate page)
- SP 800-30 explainer (risk assessment literacy, not this statutory page)
- SP 800-137 explainer (ISCM strategy and program, not this statutory page)
- SP 800-53 explainer (control catalog, not FISMA done)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.