FISMA FISMA-NIST-800-53-RMF-800-171-FIPS: Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200

FISMA is operationalized through NIST publications (mandatory per 44 USC 3553(e) + NIST FISMA Implementation Project). NIST SP 800-53 REV 5 (Security and Privacy Controls): 1,189 controls + control enhancements across 20 families (AC + AT + AU + CA + CM + CP + IA + IR + MA + MP + PE + PL + PM + PS + PT + RA + SA + SC + SI + SR); VERIFIED separately in the graph as the canonical control catalog. NIST SP 800-37 REV 2 (Risk Management Framework, RMF): 7-step process (Prepare + Categorize + Select + Implement + Assess + Authorize + Monitor); the AUTHORIZATION TO OPERATE (ATO) is the formal RMF Step 6 acceptance of residual risk by an authorizing official + may be unconditional + conditional + revocable. NIST SP 800-171 REV 3 (Protecting Controlled Unclassified Information in Nonfederal Systems): 110 controls applying to contractor systems processing CUI (Controlled Unclassified Information); enforced via DFARS 252.204-7012 + FAR 52.204-21 contract clauses; the CMMC (Cybersecurity Maturity Model Certification) Programme requires third-party assessment for DOD contractors. FIPS 199 (Federal Information Processing Standards Publication 199 - Standards for Security Categorization): LOW + MODERATE + HIGH impact levels per CIA triad. FIPS 200 (Minimum Security Requirements): mandatory minimum baseline of NIST 800-53 controls per FIPS 199 categorization. AGENCY RESPONSIBILITY: categorize systems per FIPS 199 + select baseline per FIPS 200 + implement controls per NIST 800-53 + use RMF for authorization decisions + sustain ATOs via continuous monitoring.