FISMA applies to federal government agencies in the United States, their private contractors operating federal systems, private businesses offering a service to these agencies like cloud service providers.