Navigating the labyrinth of federal compliance standards is an uphill battle even for the most experienced and savviest of government contractors or federal agencies. Case in point? FedRAMP and FISMA.
In this article, we'll guide you through what both FedRAMP and FISMA are, their similarities and differences, and an overview of their compliance requirements. We’ll also outline the many hurdles that government agencies must jump to ensure compliance. In fact, a 2020 FISMA Annual Report to Congress revealed that 30,819 cybersecurity incidents were reported in FY 2020, an 8% increase over 2019. Of these incidents, six were reported as major incidents.
FISMA was first established and enacted in 2002 as the Federal Information Security Management Act. In 2014, it was updated to the Federal Information Security Modernization Act.
While FISMA 2002 charged the Office of Management and Budget (OMB) with government-wide responsibility, FISMA 2014 makes both the OMB and the Department of Homeland Security (DHS) accountable.
FISMA requires all federal agencies to develop, document, and implement an information security program, agency-wide. The purpose of FISMA is to ensure that federal agencies protect sensitive data and information systems that support the assets and operations of the agency. This includes those provided by another federal agency, service provider, or third-party vendor.
It's noteworthy that a bipartisan bill, the Federal Information Security Modernization Act of 2022, was introduced on Jan 25, 2022, to further strengthen federal cybersecurity.
FedRAMP, or the Federal Risk and Authorization Management Program, was created by the OMB and enacted in 2011. FedRAMP requires all federal agencies that currently use, or plan to use the cloud, to go through the FedRAMP program to assess security. To become certified, cloud service providers (CSPs) must adhere to a strict series of information security standards and requirements, as well as be assessed by an authorized Third-Party Assessment Organization (3PAO). Additionally, they must provide continuous monitoring reports and updates to FedRAMP. It should be noted that CSPs are required to attain both FISMA and FedRAMP certifications.
While both FedRAMP and FISMA were enacted for separate audiences, they share a host of similarities.
The key differences between FedRAMP and FISMA are just as numerous as the similarities.
FISMA authorizations address low, moderate, or high impact levels. FedRAMP authorizations only address low to moderate impact levels.
The major high-level FedRAMP requirements to complete the FedRamp Process include:
The process for obtaining and maintaining FISMA compliance consists of six separate requirements.
Bear in mind that these are the most basic, high-level FISMA compliance requirements. There are hundreds of additional security controls that run the gamut from small technical details to program-wide decisions that impact funding, disaster recovery plans, privacy, hiring/personnel security, data protection mechanisms, and more.
FISMA applies to all agencies in the United States federal government. Since its original inception in 2002, however, FISMA has been expanded to include state agencies administering federal programs (unemployment insurance, Medicare, student loans, Medicaid, etc). FISMA was also expanded into the private sector. Any private sector company with a contractual relationship with the federal government, whether to support a federal program, receive grant money, or provide services, must comply with FISMA.
We went over the FISMA compliance requirements in the section above. But, what exactly does the compliance process entail?
The most effective way to implement these processes and maintain FISMA compliance is to use automation. Public clouds like Amazon Web Services, Microsoft Azure and Google Cloud allow you to implement autonomous compliance controls using code.
Also, keep in mind that your organization must stay current with any changes to the FISMA standards and keep detailed documentation of all of your FISMA compliance efforts. Also, encrypt everything – at rest and in transit! Data encryption is a FISMA requirement.
The best way to ensure compliance and significantly reduce the work needed to maintain compliance is to outsource to a company experienced with FISMA compliance implementation and maintenance.
FISMA is the law that dictates cybersecurity standards for U.S. federal agencies. NIST (National Institute of Standards and Technology), on the other hand, is an actual government agency that publishes security standards, including those required to successfully ensure FedRAMP and/or FISMA compliance.
FedRAMP equivalent, sometimes called FedRAMP Ready, refers to FedRAMP authorized cloud providers that meet the security requirements equivalent to the FedRAMP moderate baseline. This is covered in the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, paragraph D. The CSP must comply with the requirements outlined in paragraphs (c) through (g) of this clause. This covers cyber incident reporting, media preservation and protection, malicious software, cyber incident damage assessment, and access to additional information and equipment necessary for forensic analysis. A list of cloud service providers that are FedRAMP equivalent can be found on the FedRAMP marketplace.
Meeting the FedRAMP and FISMA requirements can be complex, but working with an experienced partner can help you simplify your compliance management strategy. Possibly even more importantly, an experienced compliance partner can take on the heavy lifting of maintaining compliance and free your teams to focus on tasks that deliver business value rather, than operational tasks. Cloudticity has the experience and track record. Cloudticity has done and continues to do extensive work with the VA on GovCloud and manages the only FISMA-High workload ever deployed to that environment.
Why go it alone? Contact Cloudticity for a free consultation. Let us help your organization traverse the intricate and complex security compliance certification process for FISMA and/or FedRAMP standards.