Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541 FISMA requires Federal agencies to establish agency-wide risk-based information security programs that include periodic risk assessments, use of controls and techniques to comply with information security standards, training requirements, periodic testing and evaluation, reporting, and plans for remedial action, security incident response, and continuity of operations. Executive Orders. The following are Executive Orders that provide details related to information security for Federal Agencies. Executive Order 10450, Security Requirements for Government Employees, April 1953 This order establishes that the interests of national security require all government employees be trustworthy, of good character, and loyal to the United States. Executive Order 13011, Federal Information Technology, July 1996 This order establishes policy for the head of each agency to effectively use information technology to improve mission performance and service to the public. Executive Order 13103, Computer Software Piracy, September 1998 This order establishes policy that each executive agency shall work diligently to prevent and combat software piracy in order to give effect to copyrights associated with computer software. Presidential Decision Directive 63: Critical Infrastructure Protection, May 1998 This directive requires that the United States take all necessary measures to swiftly eliminate any significant vulnerability to both physical and cyber attacks on critical infrastructures, including our cyber systems. Executive Order 13231, Critical Infrastructure Protection in the Information Age, October 2001 This establishes policy that ensures protection of information systems for critical infrastructure, including emergency preparedness communications, and the physical assets that support such information systems. Executive Branch Policy. The policies listed below are established through directives published by the Office of Management and Budget (OMB) based on the applicable laws passed by Congress OMB Circular Description A-11, Section 53, Information This directive specifies the identification of security and
Technology and E-Government privacy safeguards for managing sensitive information. A-123, Management Accountability and Control, as revised December 21, 2004 This directive specifies the policies and standards for establishing, assessing, correcting, and reporting on management controls in Federal agencies. A-127, Financial Management Systems, as revised by Transmittal Memorandum Number 3, December 1, 2004 This directive prescribes policies and standards for executive departments and agencies to follow in developing, operating, evaluating, and reporting on financial management systems. A-130, Appendix I, Federal Agency Responsibilities for Maintaining Records About Individuals This directive prescribes policy to agencies for the implementation of the Privacy Act and reporting requirements related to the management of personally identifiable information (PII). A-130, Appendix III, Security of Federal Automated Information Resources, as revised by Transmittal Memorandum Number 4, November 28, 2000 This directive stipulates that each agency implement a comprehensive automated information security program. The appendix establishes basic managerial and procedural controls that shall be included in Federal automated information systems. Appendix B: NIST Defined Security Control Standards IDENTIFIER SECURITY CONTROL STANDARD CLASS AC Access Control Technical AT Awareness and Training Operational AU Audit and Accountability Technical CA Security Assessment and Authorization Management CM Configuration Management Operational CP Contingency Planning Operational IA Identification and Authentication Technical IR Incident Response Operational MA Maintenance Operational MP Media Protection Operational PE Physical and Environmental Protection Operational PL Planning Management PS Personnel Security Operational RA Risk Assessment Management