The Federal Information Security Management Act (FISMA) specifies requirements for protecting federal systems and data. Enacted into law on December 17, 2002, as title III of the E-Government Act of 2002, FISMA requires every federal agency, including agencies with national security systems, to develop, document, and implement an agencywide information security program to secure the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, this program is to include periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices that include testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security incidents; plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. FISMA also assigns specific information security responsibilities to the Office of Management and Budget (OMB), NIST, agency heads, and agency chief information officers (CIO). Generally, OMB is responsible for developing policies and guidance and overseeing agency compliance with FISMA, NIST is responsible for developing technical standards, and agency heads and CIOs are responsible for ensuring that each agency implements the information security program and other requirements of FISMA. These responsibilities do not, however, apply equally to all agency information systems. FISMA differs in its treatment of national security and non-national security systems. While FISMA requires each federal agency to manage its information security risks through its agencywide information security program, the law recognizes a long-standing division between requirements for national security and non-national security systems that limits civilian management and oversight of information systems supporting military and intelligence activities. FISMA recognizes the division between national security systems and non- national security systems in two ways. First, to ensure compliance with applicable authorities, the law requires agencies using national security systems to implement information security policies and practices as required by standards and guidelines for national security systems in addition to the requirements of FISMA. Second, the responsibilities assigned by FISMA to OMB and NIST are curtailed. OMB’s responsibilities are reduced with regard to national security systems to oversight and reporting to Congress on agency compliance with FISMA. OMB’s annual review and approval or disapproval of agency information security programs, for example, does not include national security systems. Similarly, according to FISMA, NIST-developed standards, which are mandatory for non-national security systems, do not apply to national security systems. FISMA limits NIST to developing, in conjunction with DOD and the National Security Agency (NSA), guidelines for agencies on identifying an information system as a national security system, and for ensuring that NIST standards and guidelines are complementary with standards and guidelines developed for national security systems. FISMA also requires NIST to consult with other agencies to ensure use of appropriate information security policies, procedures, and techniques in order to improve information security and avoid unnecessary and costly duplication of effort. In light of this division between national security and non-national security systems, NIST is responsible for developing standards and guidance for non-national security information systems. For example, NIST issues mandatory Federal Information Processing Standards (FIPS) and special publications that provide guidance for information systems security for non-national security systems in federal agencies. For national security systems, National Security Directive 42 established CNSS, an organization chaired by the Department of Defense, to, among other things, issue policy directives and instructions that provide mandatory information security requirements for national security systems. In addition, the defense and intelligence communities develop implementing instructions and may add additional requirements where needed. FISMA provides a further exception to compliance with NIST standards. It permits an agency to use more stringent information security standards if it certifies that its standards are at least as stringent as the NIST standards and are otherwise consistent with policies and guidelines issued under FISMA. It is on the basis of this authority that the Department of Defense establishes information security standards for all of its systems (national security and non-national security systems) that are more stringent than the standards required for protecting non-national security systems under FISMA. For example, the DOD directive establishing the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) for authorizing the operation of DOD information systems requires annual certification that the DIACAP process is current and more stringent than NIST standards under FISMA. To help implement the provisions of FISMA for non-national security systems, NIST has developed a risk management framework for agencies to follow in developing information security programs. The framework is specified in NIST Special Publication (SP) 800-37, revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, which provides agencies with guidance for applying the risk management framework to federal information systems. The framework in SP 800-37 consists of security categorization, security control selection and implementation, security control assessment, information system authorization, and security control monitoring. It also provides a process that integrates information security and risk management activities into the system development life cycle. Figure 1 provides an illustration of the framework and notes relevant security guidance for each part of the framework. tem engineering prctice; pply (i.e., control implemented correctly, operting as intended, meeting ecrity reqirement for informtion tem) Other key NIST publications related to the risk management framework include the following: Federal Information Processing Standard (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems. Provides agencies with criteria to identify and categorize their information systems based on providing appropriate levels of information security according to a range of risk levels. NIST SP 800-60, revision 1, Guide for Mapping Types of Information and Information Systems to Security Categories. Provides guidance for implementing FIPS 199. FIPS 200, Minimum Security Requirements for Federal Information and Information Systems. Provides minimum information security requirements for protecting the confidentiality, integrity, and availability of federal information systems. NIST SP 800-53 revision 3, Recommended Security Controls for Federal Information Systems and Organizations. Provides guidelines for selecting and specifying security controls for information systems. NIST SP 800-70, revision 1, National Checklist Program for IT Products- Guidelines for Checklist Users and Developers. Provides guidance for using the National Checklist Repository to select a security configuration checklist, which may include items such as security controls used in FISMA system assessments. NIST SP 800-53A, revision 1, Guide for Assessing the Security Controls in Federal Information Systems. Provides agencies with guidance for building security assessment plans and procedures for assessing the effectiveness of security controls employed in information systems. In applying the provisions of FIPS 200, federal civilian agencies with non- national security systems are to first categorize their information and systems as required by FIPS 199, and then should select an appropriate set of security controls from NIST SP 800-53 to satisfy their minimum security requirements. This helps to ensure that appropriate security requirements and security controls are applied to all non-national security systems. Next, controls are implemented and information systems are authorized using NIST SP 800-70. Finally, agencies assess, test, and monitor the effectiveness of the information security controls using the guidance in NIST SP 800-53A. Many other FIPS and NIST special publications provide guidance for the implementation of FISMA requirements for non-national security systems. For national security systems, organizations responsible for developing policies, directives, and guidance include CNSS, DOD, and the intelligence community. The processes and criteria established by this guidance are often similar to those required by NIST guidance for non-national security systems. For example, security guidance for certification and accreditation requires risk assessments, verification of security requirements in a security plan or other document, testing of security controls, and formal authorization by an authorizing official. Roles of these agencies and key security guidance that they have issued are described below. CNSS provides a forum for the discussion of policy issues, sets national policy, and provides direction, operational procedures, and guidance for the security of national security systems. The Department of Defense chairs the committee under the authorities established by National Security Directive 42, issued in July 1990. This directive designates the Secretary of Defense and the Director of the National Security Agency as the Executive Agent and National Manager for national security systems, respectively. The committee has voting representatives from 21 departments and agencies. In addition, nonvoting observers such as NIST participate in meetings, provide comments and suggestions, and participate in subcommittee and working group activities. The committee organizes its activities by developing an annual program of work and plan of action and milestones. NSA provides logistical and administrative support for the committee, including a Secretariat manager who organizes the day-to-day activities of the committee. Since its inception, the committee has issued numerous policies, directives, and instructions that are binding upon all federal departments and agencies for national security systems.