FISMA 3554(a)(2)(C): 3554(a)(2)(C) Senior officials implement cost-effective risk reduction

Senior agency officials implement policies and procedures that cost-effectively reduce the risks to their information and systems to an acceptable level.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Agency head responsibilities (44 U.S.C. 3554(a)) – FISMA

3554(a)(1)(A) 3554(a)(1)(A) Protections commensurate with risk
3554(a)(1)(B) 3554(a)(1)(B) Compliance with standards, directives, OMB policy and NSS guidance
3554(a)(1)(C) 3554(a)(1)(C) Security integrated with strategic, operational and budgetary planning
3554(a)(2)(A) 3554(a)(2)(A) Senior officials assess risk and magnitude of harm
3554(a)(2)(B) 3554(a)(2)(B) Senior officials determine appropriate security levels
3554(a)(2)(D) 3554(a)(2)(D) Senior officials periodically test controls
3554(a)(3)(A) 3554(a)(3)(A) CIO authority and a qualified senior agency information security officer
3554(a)(3)(B)-(C) 3554(a)(3)(B)-(C) CIO maintains the agency-wide program and its policies and controls

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All FISMA controls