FISMA Compliance: What It Requires of Agencies and Their Contractors

FISMA compliance is a legal duty of US federal agencies, but IT companies feel it whenever they build, host or operate a system for one. The Federal Information Security Modernization Act of 2014 requires every agency to protect its information and systems, including those run by contractors, using NIST standards and guidelines, to report incidents to CISA, and to be audited every year by its inspector general. Agencies pass those requirements to vendors through contract clauses, NIST controls and, for cloud services, FedRAMP.

This guide explains what FISMA requires, who does what across OMB, CISA, NIST and agencies, how systems are categorised, assessed and authorised, what contractors are expected to do, and how FISMA differs from FedRAMP, CMMC and NIST SP 800-171.

What is FISMA?

FISMA is codified in chapter 35 of Title 44 of the US Code, starting at section 3551. Its stated purpose is to provide a framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. In short, it makes the head of each agency responsible for information security across the agency, including information collected or maintained by or on behalf of the agency and systems used or operated by contractors or other organisations on its behalf.

FISMA does not list technical controls itself. It assigns roles and points to standards:

• OMB oversees agency information security policies and practices and reports to Congress.
• The Department of Homeland Security, through CISA, administers implementation of agency security policies, issues binding operational directives and emergency directives, operates the federal incident response centre and provides tools and services.
• NIST develops standards and guidelines, including Federal Information Processing Standards (FIPS) that are mandatory for agencies, and Special Publications such as SP 800-53 and SP 800-37.
• Agency heads, chief information officers and chief information security officers run the agency programme.
• Inspectors general perform annual independent evaluations.

History and why FISMA was introduced

The original Federal Information Security Management Act was Title III of the E-Government Act of 2002. It responded to repeated findings that federal information security was weak and inconsistent, and it created the model of agency-wide programmes, NIST standards and annual evaluations. Over time, critics argued it had become a compliance paperwork exercise focused on periodic documentation rather than real-time risk.

The Federal Information Security Modernization Act of 2014 updated the law. It formally gave DHS authority to administer implementation and issue binding operational directives, emphasised continuous diagnostics and monitoring rather than periodic paperwork, required notification to Congress of major incidents, and encouraged automated security tools. Since then, OMB memos, CISA directives (such as those requiring remediation of known exploited vulnerabilities) and executive orders on cybersecurity have shaped how FISMA is implemented.

Who must comply with FISMA?

• Federal executive agencies, directly.
• Contractors and other organisations operating information systems on behalf of an agency, through the agency's responsibility and contract terms. This includes system integrators running agency systems, software vendors hosting agency applications, and IT support contractors with privileged access.
• Cloud service providers serving agencies, through FedRAMP, which implements FISMA requirements for cloud services.
• State agencies administering federal programmes may receive FISMA-derived requirements in agreements with federal agencies.

Contractors that hold Controlled Unclassified Information in their own systems, rather than operating a system for the agency, are usually covered by NIST SP 800-171 and, for defence work, CMMC, instead of the full FISMA control set.

Key requirements

An agency-wide information security programme

Each agency must develop, document and implement a programme that includes periodic risk assessments, risk-based policies and procedures, security plans for systems, security awareness training, periodic testing and evaluation of controls, a process for remedial action, incident detection, reporting and response, and continuity plans.

Mandatory standards and guidelines

• FIPS 199: categorise information and systems as low, moderate or high impact for confidentiality, integrity and availability.
• FIPS 200: minimum security requirements in 17 areas.
• NIST SP 800-53 and SP 800-53B: select and tailor controls from baselines.
• NIST SP 800-37: the Risk Management Framework for categorising, selecting, implementing, assessing, authorising and monitoring.
• FIPS 140: validated cryptographic modules where cryptography protects sensitive federal information.

Categorising a system: a worked example

FIPS 199 asks, for each type of information in a system, what the potential impact would be (low, moderate or high) if confidentiality, integrity or availability were lost. The system takes the highest value across all three, often called the "high water mark". Consider a grants management application that holds applicant contact details and financial information. Unauthorised disclosure could cause serious harm to applicants (moderate confidentiality). Altering award amounts could cause serious financial harm (moderate integrity). An outage of a few days would be disruptive but recoverable (low availability). The system is therefore moderate overall, and the moderate baseline in SP 800-53B becomes the starting point for control selection. NIST SP 800-60 provides guidance on mapping information types to impact levels, which helps agencies and contractors make these judgements consistently.

FIPS 200 minimum security areas

FIPS 200 sets minimum security requirements in 17 areas that every federal system must address, which correspond to the security control families in SP 800-53: access control; awareness and training; audit and accountability; certification, accreditation and security assessments; configuration management; contingency planning; identification and authentication; incident response; maintenance; media protection; physical and environmental protection; planning; personnel security; risk assessment; systems and services acquisition; system and communications protection; and system and information integrity. Later revisions of SP 800-53 added further families, such as program management, supply chain risk management and PII processing, but these 17 areas remain the minimum floor. For a vendor, they are a useful checklist of the topics an agency assessment will cover, from staff training records to media sanitisation.

Authorisation to operate

Before a system goes into production, an authorising official reviews the security plan, assessment report and plan of action and milestones, and accepts the residual risk by issuing an authorisation to operate (ATO). Agencies increasingly use ongoing authorisation supported by continuous monitoring rather than fixed three-year cycles.

Incident reporting

Agencies must report incidents to CISA following federal incident notification guidelines, which set short reporting windows, and must notify Congress of major incidents within the timeframe in the Act and OMB guidance. Contracts typically require contractors to report incidents to the agency quickly enough for the agency to meet these deadlines.

CISA directives

Binding operational directives and emergency directives require agencies to take specific actions, such as patching vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalogue within set timelines. Contractors operating agency systems are expected to support compliance.

Annual evaluation and reporting

Each agency's inspector general (or an independent auditor) evaluates the agency's programme every year using metrics set by OMB, CISA and the Council of the Inspectors General. The IG metrics use a five-level maturity model, from ad hoc to optimised, organised around the NIST Cybersecurity Framework functions. Agencies also report CIO metrics, and OMB reports to Congress.

What contractors are expected to do

• Implement the security controls specified in the contract, typically a FIPS 199 based SP 800-53 baseline for the system you operate.
• Support the agency's assessment and authorisation, including providing a system security plan and evidence.
• Use FIPS 140 validated cryptography where required.
• Report incidents to the agency within the contract's timeframe and cooperate with investigations.
• Maintain continuous monitoring: vulnerability scanning, configuration monitoring, log review.
• Meet personnel requirements, such as background investigations for staff with privileged access.
• Follow CISA directives as the agency requires.
• Flow requirements down to subcontractors.

Continuous monitoring in practice

The 2014 law and later OMB policy moved agencies away from point-in-time paperwork toward continuous monitoring. For a contractor operating an agency system, that usually means a recurring rhythm rather than an annual scramble:

• Continuously: automated asset discovery, configuration compliance checks, log collection and alerting, and vulnerability scanning of hosts, containers and applications.
• Monthly: a report to the agency with scan results, open findings and their status, changes made to the system, and any incidents.
• On change: a security impact analysis before significant changes, with agency notification or approval as the contract requires.
• Annually: assessment of a subset of controls, review and update of the security plan, contingency plan testing and training.

Many agencies feed this data into the government's Continuous Diagnostics and Mitigation (CDM) program dashboards run with CISA. Contractors that can export accurate, machine-readable inventory and vulnerability data make the agency's job, and their own reviews, far easier.

How to approach FISMA as a vendor, step by step

1. Read the contract clauses and identify which system, impact level and controls apply.
2. Confirm the categorisation under FIPS 199 with the agency.
3. Map controls from the SP 800-53 baseline to your system, noting what is inherited from the agency or a FedRAMP-certified provider.
4. Write the system security plan and supporting procedures.
5. Implement and test controls, especially access control, logging, configuration management and vulnerability management.
6. Support the independent assessment and fix findings.
7. Obtain the ATO through the agency.
8. Run continuous monitoring and report as required.
9. Prepare for audits: IG evaluators may test controls on contractor-operated systems.

Documentation required

• System security plan and privacy plan.
• FIPS 199 categorisation.
• Policies and procedures for each control family.
• Security assessment plan and report.
• Plan of action and milestones.
• Authorisation decision documentation.
• Contingency plan and test results; incident response plan.
• Configuration management plan and inventories.
• Continuous monitoring strategy and reports.

Audits and assessment

FISMA has no certification. Agencies assess systems through the RMF, IGs evaluate agency programmes annually, and the Government Accountability Office reviews federal cybersecurity. Contractors can expect agency security assessments, IG testing of systems they operate, and contract performance reviews. For cloud services, FedRAMP certification provides the reusable assessment.

Timeline and cost considerations

Timelines are set by the agency's authorisation process and the system's impact level. Cost drivers include control implementation, FIPS-validated cryptography, documentation, independent assessment, continuous monitoring tooling, cleared personnel where needed, and staff time to support audits. Inheriting controls from FedRAMP-certified platforms reduces both.

Benefits and consequences of non-compliance

For vendors, meeting FISMA requirements is a condition of working on federal systems, and the same capabilities strengthen security for all customers.

FISMA has no direct civil fines on companies. Consequences for agencies include adverse IG findings and congressional scrutiny; for contractors, they include contract remedies, loss of ATO, termination, and exclusion from future work. Knowingly misrepresenting cybersecurity compliance to the government can lead to liability under the False Claims Act, which the Department of Justice has pursued through its Civil Cyber-Fraud Initiative.

Common mistakes and challenges for IT companies

• Confusing FISMA with FedRAMP. FISMA is the law for agencies; FedRAMP is the program for cloud services under it.
• Assuming commercial certifications are enough. SOC 2 or ISO/IEC 27001 help but do not replace NIST-based controls and agency authorisation.
• Non-validated cryptography discovered late.
• Weak incident reporting paths that cannot meet agency deadlines.
• Outdated security plans that no longer match the system after changes.
• Not flowing requirements to subcontractors.

Best practices, tools and technologies

• Build on FedRAMP-certified infrastructure and inherit controls where possible.
• Automate asset inventory, configuration monitoring and vulnerability scanning to support continuous monitoring.
• Track CISA's Known Exploited Vulnerabilities catalogue and patch on its timelines.
• Use phishing-resistant MFA for privileged users.
• Keep the system security plan as structured data (for example OSCAL) so it stays current.
• Use the NIST CSF functions to report maturity, matching the IG metrics.

We maintain applications to these expectations through our support plans and modernise legacy agency applications in migration projects.

How FISMA relates to other frameworks

Framework	Relationship
NIST SP 800-53	The control catalogue agencies must use under FISMA.
NIST RMF	The process for authorising systems under FISMA.
FedRAMP	Implements FISMA requirements for cloud services used by agencies.
NIST SP 800-171 and CMMC	Requirements for contractors' own systems holding CUI, rather than systems operated for an agency.
NIST CSF	Used to structure IG maturity metrics and agency risk management.

Real-world implementation examples

Inspectors general publish annual FISMA evaluations for their agencies, and the Government Accountability Office publishes reports on federal information security. These documents show recurring themes such as incomplete asset inventories, weak configuration management and slow remediation, which are the same areas contractors should strengthen. CISA's directive on known exploited vulnerabilities set specific remediation deadlines that agencies, and the contractors operating their systems, have had to meet.

An illustrative case for a software vendor hosting a case management application for an agency: the system is categorised moderate. The vendor moves hosting to a FedRAMP-certified platform, implements MFA, central logging and automated scanning, writes a system security plan inheriting physical and some network controls from the platform, supports the agency's assessment, and receives an ATO. Monthly continuous monitoring reports and quick patching of known exploited vulnerabilities keep the authorisation in good standing.

Next steps

1. Review your contract's security clauses and impact level, and list every deadline the contract sets for reporting and remediation.
2. Map controls and inheritance.
3. Close gaps in cryptography, logging, configuration and vulnerability management.
4. Prepare the security plan and support assessment.
5. Set up continuous monitoring and incident reporting, and rehearse an incident with the agency's contacts.

Frequently asked questions

Does FISMA apply to private companies?

Not directly. It applies to federal agencies, and through contracts to companies operating systems or handling information on an agency's behalf.

What is the difference between FISMA and FedRAMP?

FISMA is the law requiring agencies to secure their information and systems. FedRAMP is the program that standardises how cloud services used by agencies are assessed and certified under that law.

Is there a FISMA certification?

No. Systems receive an authorisation to operate from an agency official after assessment. There is no general FISMA certificate for a company.

What NIST standards does FISMA require?

FIPS 199 for categorisation, FIPS 200 for minimum requirements, SP 800-53 for controls, SP 800-37 for the Risk Management Framework, and FIPS 140 for cryptographic modules, among others.

What is an ATO?

An authorisation to operate: a decision by an agency's authorising official to accept the risk of operating a system based on its security assessment.

What changed in FISMA 2014?

It formally gave DHS authority to administer implementation and issue binding directives, emphasised continuous monitoring, and added requirements to notify Congress of major incidents.

Who audits FISMA compliance?

Each agency's inspector general or an independent auditor evaluates the agency's programme annually; GAO also reviews federal information security.

Do contractors have to report incidents?

Yes, under their contracts, usually within short timeframes so that agencies can meet their own reporting duties to CISA.

Are there penalties for contractors?

FISMA itself has no fines for companies, but contractors can lose contracts or authorisations, and false statements about security compliance can lead to False Claims Act liability.

Do FISMA requirements apply to state agencies?

When state agencies operate systems or handle information for federal programmes, federal agreements often impose FISMA-derived requirements on them.

What is the high water mark in FIPS 199?

The practice of categorising a system at the highest impact level found across confidentiality, integrity and availability for all its information types. A system that is moderate in one area and low in the others is a moderate system.

How does FISMA relate to NIST 800-171?

SP 800-171 covers protecting CUI in nonfederal systems, such as a contractor's own network. FISMA and SP 800-53 cover federal systems, including those operated by contractors for agencies.