# Presentation: 914080

## Federal Information Security Management Act(FISMA)

**Timothy C. Fitzgerald**
**U.S. Department of State**
**February 2004**

**A FISMA Reference Model**

**Notes:**
Greeting this an approach which addresses the fundamental basis of FISMA.  It will take into account the statute, regulations and implementation requirements of FISMA and other legislation.

## Agenda

**  ****History Statutes and Guidelines**
**  ****Assumptions**
**  ****FISMA Overview**
**  ****The Agency Program**
**  ****Supporting the Processes**
**  ****Plan of Actions and Milestones**
**  ****Audit and Inspection Areas**
**  ****Timeline**
**  ****Report Building**
**  ****Next Steps**

## Assumptions

**Definitions **
**IT Inventory**
**Accountability**

## History and Statutes

**1929: **Federal Records Act
**1942: **Federal Reports Act
**1947: **Hoover Commission
**1949: **Federal Property and Administrative Services Act
**1952: **Still-classified Executive Order establishing NSA
**1965: **Brooks Automatic Data Processing Act (Brooks Act)
**1974:** Privacy Act
**1978: **Inspectors General Act
**1984: **NSDD-145: National Policy for the Security of National Security Telecommunications and Information Systems
**1988: **Warner Amendment to Brooks Act
**1987: **Computer Security Act of 1987
**1990: **NSD-42: National Policy for the Security of National Security Telecommunications and Information Systems
**1990**: Chief Financial Officers Act
**1993: **Government Performance and Results Act (GPRA)
**1995: **Paperwork Reduction Act of 1995 OMB Circular A-130, App. III, Security of Federal Automated Information

- Executive Order 13010, Critical Infrastructure Protection
- Executive Order 13011, Federal Information Technology
**1996: **Information Technology Management Reform Act (renamed Clinger-Cohen Act of 1996)
- Health Insurance Portability and Accountability Act  (HIPPA) (updating Privacy Act)
**1997: **President’s Commission on Critical Infrastructure Protection releases report
**1998: **PDD-63, *Protecting America’s Critical Infrastructures*
- Government Paperwork Elimination Act (GPEA)
**2000:** Government Information Security Reform Act (GISRA) (formerly Thompson-Liebermann Act)
**2001**: USA Patriot Act
**2002:** Homeland Security Act (Title X – Information Security) replaced by E-Government Act - Federal Information Security Management Act (FISMA)
**2003**: Homeland Security Presidential Directive/Hspd-7

## Guidelines

**OMB Circular and Memoranda**
**National Institute of Standards and Technology** (NIST) **FIPS and SP**
**Committee for National Security Systems** (formerly National Telecommunications and Information Systems Security Committee(NTISSC))
**Federal Information Systems Control Audit Manual (FISCAM) **

**This Reference Model**** **

- Senior Agency Information Systems Security Officer

**Notes:**
First, understanding the model.  Nothing new, a typical agency with high level goals and objectives to support its mission.  An enterprise architecture to support the requirements, technology refreshment via capital planning and certification and accreditation providing risk management process.  FISMA requires that the CIO have an agency-wide program to provide an level of protection to the information and an inventory of the systems and programs requiring protection.

**Agency Mission**

**Office of Management and Budget**
**(OMB)**

**FIPS and**
** ****Special Publications**

**Memoranda &**
**Circulars**

**11331 Title 40**

**Notes:**
Understanding the agency mission and relationship to OMB and NIST is a requirement.  Some managers do not want to acknowledge this and attempt to bypass these requirements.  OMB implementation guidance normally gets stringent reviews before becoming a Circular, Memoranda, or Bulletin. 

NIST provides the technical implementation framework for the agency.  These are normally transmitted as Federal Information Processing Standards (FIPS), special publications, information technology bulletins.

The combination of the two organizations provides the criteria that should be used for reviewing the agency.

## This Reference Model 

**Agency-wide Security Program**
- §3544(b)

**This Reference Model**** **

- Senior Agency Information Security Officer

- Senior Agency Officials

**Notes:**
First, understanding the model.  Nothing new, a typical agency with high level goals and objectives to support its mission.  An enterprise architecture to support the requirements, technology refreshment via capital planning and certification and accreditation providing risk management process.  FISMA requires that the CIO have an agency-wide program to provide an level of protection to the information and an inventory of the systems and programs requiring protection.

**Agency-wide Security Program**

**Information Assurance Program**

- Senior Agency Information Security Officer

**Office of **
**Management**
** ****and Budget**
**(OMB)**

**Notes:**
FISMA and other guidance requires the agency to have an information security program.  FISMA just requires that responsibility for the information security program is on the CIO for implementation.

This approach makes some assumptions... 1. the agency has an enterprise architecture in place and functional;  2. the agency has a capital planning process implemented.  If these functions and processes are not implemented then you have an issue with Clinger-Cohen (ITRMA) on the effectiveness and efficiency of information management.

The agency-wide security program should be blessing and approval by OMB, along with having performance measures for the information assurance activities.  The information assurance activities might cover several programs and services of the agency formulating the basis for risk management.

NIST this month released metrics guidance to the agencies for tracking security programs.

**Agency-wide Security Program**

**Security Policy**
**Architecture**
**Access Controls**
**Network Monitoring**
**Personnel Security**
**Mainframe Security**
**Education, Training and Awareness**
**Physical and Environmental Security **

**Systems Evaluations**
**Continuity of Services**
**Technical Security **
**Technical  Security Countermeasures**
**Enterprise Network Management**
**Lifecycle Management**
**Virus Program **
**Computer Emergency Response Capability**
**Cryptographic Services**

**Notes:**
Examples of programs which might be classified as information assurance activities supporting risk management.

**Agency Information ****System and Programs**

**Mission Program Plans**
**Information Management**
**Modernization Plans**

- Senior Agency Officials

**Notes:**
The agency CIO should have an inventory of the information systems programs of the agency.  These programs should relate directly to the agency’s mission and administrative responsibilities.  In most cases you will find a 2 – 2.5 to 1 administrative to program systems.  This condition is related to financial management statutes requiring accountability of public funds.  While the program manager might have several systems for processing and tracking the information regarding their program, while the budget officer has several to account for the procurement, logistic, payment, payroll, etc.  These systems should have some classification to distinguish administrative programs and mission related programs. 

**Capital Investment Planning **

**Capital Investment Process**

**Office of **
**Management**
** ****and Budget**
**(OMB)**

**Notes:**
The Capital Investment Fund process to support OMB A-11 submissions is a difficult process to translate to the program management staff because most are not involve.  First understanding the definition of projects and programs would serve as the basis.  The programs are those activities that provide support to the mission and administrative responsibilities of the agencies.  While projects are new and improvement initiatives to the day-to-day programs.  Funding for programs should be base funded and maybe augmented with CIF, while projects is fully CIF.  If the project fails to meet its expectations then it could be cancelled without impacting the program daily operations.

Under guidance from OMB, the A-11 process along with IT Security should provide the agency with enough of a framework to integrate the A-11 process into the IT lifecycle process.  The program / project manager should have the training to develop and manage the documentation needed to support the A-11 process.  

Once the project /program manager has developed and submitted their respective initiatives, then the CIO should have  

**Certification**
** ****and**
** ****Accreditation **

**Certification and Accreditation**

**Risk Management**

**Information**
** ****Requirements**

**Technology**
**Modernization**
**Projects**

**Balance of **
**Requirements and Technology**
**vs.**
**Vulnerabilities, Threats and Risk**

**Notes:**
Once you know the requirements based on the mission, goals and objectives then determine the technology that best meet your initiative.  Using the Capital Planning process, submit the plan for the project and as you develop and refine the project, start the C & A process.  Once the project is ready for deployment the vulnerabilities and risk would have been minimized.  The goal of balancing the vulnerabilities, threats and risk is key to identifying C&A. 

**This Reference Model**** **

- Senior Agency Information Security Officer

**Notes:**
First, understanding the model.  Nothing new, a typical agency with high level goals and objectives to support its mission.  An enterprise architecture to support the requirements, technology refreshment via capital planning and certification and accreditation providing risk management process.  FISMA requires that the CIO have an agency-wide program to provide an level of protection to the information and an inventory of the systems and programs requiring protection.

## Plans of Action and Milestones

**IT Audit Findings**
**IT Inspections Findings**
**C&A Residual Findings **
**IATO**
**Denials**
**CIP Assessments**
**Self-Assessments (NIST SP800-26)**
**GAO Audits**

**PoA&Ms**

**Plans of Action and Milestones**

**Risk Management **
**Prioritize IT Spending **
**Fixing The Important Weakness first**

- CIO

- Agency Head

**Capital**
**Investment**
**Planning**
- CCA

**Notes:**
The Capital Investment Fund process to support OMB A-11 submissions is a difficult process to translate to the program management staff because most are not involve.  First understanding the definition of projects and programs would serve as the basis.  The programs are those activities that provide support to the mission and administrative responsibilities of the agencies.  While projects are new and improvement initiatives to the day-to-day programs.  Funding for programs should be base funded and maybe augmented with CIF, while projects is fully CIF.  If the project fails to meet its expectations then it could be cancelled without impacting the program daily operations.

Under guidance from OMB, the A-11 process along with IT Security should provide the agency with enough of a framework to integrate the A-11 process into the IT lifecycle process.  The program / project manager should have the training to develop and manage the documentation needed to support the A-11 process.  

Once the project /program manager has developed and submitted their respective initiatives, then the CIO should have  

## Audit

**  ****Asset Management    **
**  ****Enterprise Architecture **
**  ****Technology Capital Investment Planning**
**  ****Certification and Accreditation**
**   ****Information Assurance Programs**
**  ****Agency Information System Programs**

## Inspection 

**  ****Management Controls**
**  ****Roles And Responsibility Implementation **
**  ****Policy And Procedures Implementation**
**  ****Operational Controls**
**  ****Executed Logs, Checklist, Procedural Documents**
**  ****Technical Controls**
**  ****Validation Assessments**

## FISMA Timeline

- Oct     Nov     Dec     Jan     Feb     Mar     Apr     May     Jun     Jul     Aug     Sep

**4th Quarter **
**PoAMS**

**Agency Corrective **
**Action Plans**

**1st Quarter **
**PoAMS**

**2nd Quarter **
**PoAMS**

**3rd Quarter **
**PoAMS**

**OMB FISMA Report to**
**Congress**

**Agency**
**FISMA **
**Report**

**FISMA Timeline**

## Building the Report

**Clearly Defined Roles And Responsibilities**
**An Approved Agency-wide Security Plan**
**An IT Asset And Logistic Process **
**Realistic Certification And Accreditation Process And Schedule**
**Integration Of The POAM Reporting Into The Management Process**
**Cross Statute Issues **
**Rollup Of Inspections And Audit Findings**

## Next Steps

**  ****Modify Audit And Inspection Guidelines**
**  ****Plan Security Program Reviews**
**  ****Fiscal Timeline For Reporting**
**  ****Rollup Results To FISMA Report**

## A FISMA Model

**Questions**
**Timothy C. Fitzgerald**
**U.S. Department of State**
**Fitzgeraldtc@state.gov**
**703-284-2650**