FISMA 3554(b)(2): 3554(b)(2) Risk-based policies and procedures across the life cycle

The program includes policies and procedures that are based on the risk assessments, cost-effectively reduce information security risk to an acceptable level, address information security throughout the life cycle of each system, and ensure compliance with the subchapter, OMB policies, NIST standards, minimally acceptable system configuration requirements the agency determines, and any other applicable requirements including national security system standards.