FISMA 3554(a)(7): All personnel accountable for the program

What does 3554(a)(7) require?

The agency head ensures that all personnel are held accountable for complying with the agency-wide information security program.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

3554(a)(1)(A) 3554(a)(1)(A) Protections commensurate with risk
3554(a)(1)(B) 3554(a)(1)(B) Compliance with standards, directives, OMB policy and NSS guidance
3554(a)(1)(C) 3554(a)(1)(C) Security integrated with strategic, operational and budgetary planning
3554(a)(2)(A) 3554(a)(2)(A) Senior officials assess risk and magnitude of harm
3554(a)(2)(B) 3554(a)(2)(B) Senior officials determine appropriate security levels
3554(a)(2)(C) 3554(a)(2)(C) Senior officials implement cost-effective risk reduction
3554(a)(2)(D) 3554(a)(2)(D) Senior officials periodically test controls
3554(a)(3)(A) 3554(a)(3)(A) CIO authority and a qualified senior agency information security officer

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.