FISMA: National Security Systems Exclusion + CIRCIA + Zero Trust
FISMA FISMA-CIRCIA-ZTA-EO14028: CIRCIA, Zero Trust Architecture, EO 14028 + 14110 + OMB Memoranda
FISMA coordination with CIRCIA + Zero Trust + Executive Orders + OMB Memoranda. CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act of 2022): Final Rule effective 2026; expands incident reporting beyond FISMA-covered agencies to CRITICAL INFRASTRUCTURE entities; covered entities must report cyber incidents within 60 HOURS + ransom payments within 24 HOURS; supervised by CISA. ZERO TRUST ARCHITECTURE (ZTA): OMB MEMORANDUM M-22-09 (January 2022) - Moving the US Government Toward Zero Trust Cybersecurity Principles - sets federal Zero Trust strategy + 5 pillars (Identity + Devices + Network + Applications + Data) + mandates FY24 ZTA targets + 2024 ZTA STRATEGY update; CISA ZERO TRUST MATURITY MODEL v2 (2023) + provides 5-pillar + 3-maturity-level framework; phishing-resistant authentication mandatory; least-privilege + micro-segmentation expected. EXECUTIVE ORDERS: EO 14028 (May 2021 Improving the Nation Cybersecurity) - federal SBOM + Zero Trust + EDR + cloud security baselines; EO 14110 (October 2023 AI Executive Order - revoked January 2025 + replaced by 2025 EO on AI in Government) - federal AI safety + bias testing + watermarking + critical-infrastructure-AI; EO 14117 (February 2024 Cross-Border Data Transfer) - restrictions on data flows to countries of concern. OMB MEMORANDA: M-22-09 ZTA; M-22-18 SBOM Producer Attestation; M-23-02 Cybersecurity Information Sharing; M-24-15 FedRAMP Modernization; M-24-04 Annual FISMA Reporting Guidance.
What else in your programme already covers this
This control maps to 196 controls across 73 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.