FISMA
FISMA is the Federal Information Security Modernization Act of 2014 (Public Law 113-283), amending the Federal Information Security Management Act of 2002 + codified at 44 USC Chapter 35 Subchapter II (sections 3551-3559). FISMA is the US federal statutory framework for information security applying to all federal agencies (excluding national-security systems covered separately) + contractors operating systems on behalf of federal agencies. STATUTORY STRUCTURE: (a) Section 3551 PURPOSES; (b) Section 3552 DEFINITIONS; (c) Section 3553 AUTHORITY AND FUNCTIONS OF THE DIRECTOR OF OMB + CISA (Cybersecurity and Infrastructure Security Agency, at DHS) including BINDING OPERATIONAL DIRECTIVES (BODs) for federal civilian agencies; (d) Section 3554 FEDERAL AGENCY RESPONSIBILITIES - including agency CIO + CISO designations + agency-wide information security programs + risk assessments + incident reporting; (e) Section 3555 ANNUAL INDEPENDENT EVALUATION by agency Inspector General (IG); (f) Section 3556 FEDERAL INFORMATION SECURITY INCIDENT CENTER (US-CERT now CISA); (g) Section 3557 NATIONAL SECURITY SYSTEMS (NSS) - exclusion from FISMA + governed separately by CNSS + Intelligence Community Directive 503; (h) Section 3558 EFFECT ON EXISTING LAW; (i) Section 3559 SAVINGS PROVISIONS. OPERATIONALISATION: FISMA is implemented through: (1) NIST SP 800-53 Rev 5 (Security and Privacy Controls - 1,189 controls) - VERIFIED separately in graph; (2) NIST SP 800-37 Rev 2 (Risk Management Framework - Categorize + Select + Implement + Assess + Authorize + Monitor); (3) NIST SP 800-171 Rev 3 (Protecting Controlled Unclassified Information in Nonfederal Systems) for contractor systems; (4) FIPS 199 (system categorization Low + Moderate + High); (5) FIPS 200 (minimum security requirements); (6) FedRAMP (Federal Risk and Authorization Management Program for cloud) - VERIFIED separately in graph as FedRAMP Moderate + High + Rev 5 Program reference; (7) CISA Binding Operational Directives (BODs - e.g. BOD 22-01 KEV Catalog, BOD 23-01 Asset Visibility, BOD 23-02 Internet-Accessible Networking Devices); (8) OMB Memoranda (M-22-09 Zero Trust + M-22-18 SBOM + M-24-15 FedRAMP modernization). 2024-2025 PRIORITIES: ZERO TRUST ARCHITECTURE per OMB M-22-09 + CISA Zero Trust Maturity Model v2 + the National Cybersecurity Strategy + CIRCIA Final Rule 2026 alignment.
FISMA is a compliance framework from United States federal government with 6 domains and 38 controls that map to 87 other frameworks. The largest domains are Agency head responsibilities (44 U.S.C. 3554(a)) – FISMA (14 controls), Agency-wide information security program (44 U.S.C. 3554(b)) – FISMA (9 controls), Annual independent evaluation (44 U.S.C. 3555) – FISMA (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Agency head responsibilities (44 U.S.C. 3554(a)) – FISMA
| Code | Title |
|---|---|
| fisma::3554(a)(1)(A) | 3554(a)(1)(A) Protections commensurate with risk |
| fisma::3554(a)(1)(B) | 3554(a)(1)(B) Compliance with standards, directives, OMB policy and NSS guidance |
| fisma::3554(a)(1)(C) | 3554(a)(1)(C) Security integrated with strategic, operational and budgetary planning |
| fisma::3554(a)(2)(A) | 3554(a)(2)(A) Senior officials assess risk and magnitude of harm |
| fisma::3554(a)(2)(B) | 3554(a)(2)(B) Senior officials determine appropriate security levels |
| fisma::3554(a)(2)(C) | 3554(a)(2)(C) Senior officials implement cost-effective risk reduction |
| fisma::3554(a)(2)(D) | 3554(a)(2)(D) Senior officials periodically test controls |
| fisma::3554(a)(3)(A) | 3554(a)(3)(A) CIO authority and a qualified senior agency information security officer |
| fisma::3554(a)(3)(B)-(C) | 3554(a)(3)(B)-(C) CIO maintains the agency-wide program and its policies and controls |
| fisma::3554(a)(3)(D)-(E) | 3554(a)(3)(D)-(E) CIO trains and oversees security personnel and assists senior officials |
| fisma::3554(a)(4) | 3554(a)(4) Sufficient trained personnel |
| fisma::3554(a)(5) | 3554(a)(5) CIO annual report to the agency head |
| fisma::3554(a)(6) | 3554(a)(6) Senior and component officials carry out their responsibilities |
| fisma::3554(a)(7) | 3554(a)(7) All personnel accountable for the program |
Agency reporting, performance plan and public notice (44 U.S.C. 3554(c) to (e)) – FISMA
| Code | Title |
|---|---|
| fisma::3554(c)(1)(A) | 3554(c)(1)(A) Annual report to OMB, DHS, Congress and GAO |
| fisma::3554(c)(1)(B) | 3554(c)(1)(B) Unclassified report with maximum content |
| fisma::3554(c)(2) | 3554(c)(2) Security addressed in management plans and reports |
| fisma::3554(d) | 3554(d) Security resources in the performance plan |
| fisma::3554(e) | 3554(e) Public notice and comment on policies affecting the public |
Agency-wide information security program (44 U.S.C. 3554(b)) – FISMA
| Code | Title |
|---|---|
| fisma::3554(b) | 3554(b) An agency-wide information security program |
| fisma::3554(b)(1) | 3554(b)(1) Periodic risk assessments |
| fisma::3554(b)(2) | 3554(b)(2) Risk-based policies and procedures across the life cycle |
| fisma::3554(b)(3) | 3554(b)(3) Subordinate security plans |
| fisma::3554(b)(4) | 3554(b)(4) Security awareness training for all users |
| fisma::3554(b)(5) | 3554(b)(5) Testing and evaluation at least annually with automated tools |
| fisma::3554(b)(6) | 3554(b)(6) Remedial action process |
| fisma::3554(b)(7) | 3554(b)(7) Incident detection, reporting and response, with seven-day major incident notice to Congress |
| fisma::3554(b)(8) | 3554(b)(8) Continuity of operations plans |
Annual independent evaluation (44 U.S.C. 3555) – FISMA
| Code | Title |
|---|---|
| fisma::3555(a) | 3555(a) Annual independent evaluation of the program |
| fisma::3555(b) | 3555(b) Evaluation by the Inspector General or an independent external auditor |
| fisma::3555(c) | 3555(c) National security systems evaluated by a designated entity |
| fisma::3555(d) | 3555(d) Reliance on existing audits and evaluations |
| fisma::3555(e) | 3555(e) Evaluation results submitted to OMB |
| fisma::3555(f) | 3555(f) Protection of evaluation information |
Data breach notification (section 2(d) of the Act) – FISMA
| Code | Title |
|---|---|
| fisma::S2(d)(1)(A) | S2(d)(1)(A) Breach notice to Congress within 30 days |
| fisma::S2(d)(1)(B) | S2(d)(1)(B) Breach notice to affected individuals without unreasonable delay |
National security systems and incident information sharing (44 U.S.C. 3556(b), 3557) – FISMA
| Code | Title |
|---|---|
| fisma::3556(b) | 3556(b) National security system agencies share incident information with the center |
| fisma::3557 | 3557 Agency head responsibilities for national security systems |
Your Compliance Coverage
If you comply with FISMA, you already cover:
BSI IT-Grundschutz
6%
3 controls mapped
Compare →Vietnam Law on Cybersecurity (No. 116/2025/QH15)
6%
3 controls mapped
Compare →Vermont Data Privacy and Online Surveillance Act
6%
3 controls mapped
Compare →+ 84 more: US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule (6%), US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements (6%)
See all 87 mapped frameworks ↓Maps to 87 other frameworks
Coverage is not the same as your position
This page shows what FISMA overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is FISMA and who does it apply to?
FISMA is a compliance framework from United States federal government with 6 domains and 38 controls. FISMA is the Federal Information Security Modernization Act of 2014 (Public Law 113-283), amending the Federal Information Security Management Act of 2002 + codified at 44 USC Chapter 35 Subchapter II (sections 3551-3559). FISMA is the US federal statutory framework for information security applying to all federal agencies (excluding national-security systems covered separately) + contractors operating systems on behalf of federal agencies. STATUTORY STRUCTURE: (a) Section 3551 PURPOSES; (b) Section 3552 DEFINITIONS; (c) Section 3553 AUTHORITY AND FUNCTIONS OF THE DIRECTOR OF OMB + CISA (Cybersecurity and Infrastructure Security Agency, at DHS) including BINDING OPERATIONAL DIRECTIVES (BODs) for federal civilian agencies; (d) Section 3554 FEDERAL AGENCY RESPONSIBILITIES - including agency CIO + CISO designations + agency-wide information security programs + risk assessments + incident reporting; (e) Section 3555 ANNUAL INDEPENDENT EVALUATION by agency Inspector General (IG); (f) Section 3556 FEDERAL INFORMATION SECURITY INCIDENT CENTER (US-CERT now CISA); (g) Section 3557 NATIONAL SECURITY SYSTEMS (NSS) - exclusion from FISMA + governed separately by CNSS + Intelligence Community Directive 503; (h) Section 3558 EFFECT ON EXISTING LAW; (i) Section 3559 SAVINGS PROVISIONS. OPERATIONALISATION: FISMA is implemented through: (1) NIST SP 800-53 Rev 5 (Security and Privacy Controls - 1,189 controls) - VERIFIED separately in graph; (2) NIST SP 800-37 Rev 2 (Risk Management Framework - Categorize + Select + Implement + Assess + Authorize + Monitor); (3) NIST SP 800-171 Rev 3 (Protecting Controlled Unclassified Information in Nonfederal Systems) for contractor systems; (4) FIPS 199 (system categorization Low + Moderate + High); (5) FIPS 200 (minimum security requirements); (6) FedRAMP (Federal Risk and Authorization Management Program for cloud) - VERIFIED separately in graph as FedRAMP Moderate + High + Rev 5 Program reference; (7) CISA Binding Operational Directives (BODs - e.g. BOD 22-01 KEV Catalog, BOD 23-01 Asset Visibility, BOD 23-02 Internet-Accessible Networking Devices); (8) OMB Memoranda (M-22-09 Zero Trust + M-22-18 SBOM + M-24-15 FedRAMP modernization). 2024-2025 PRIORITIES: ZERO TRUST ARCHITECTURE per OMB M-22-09 + CISA Zero Trust Maturity Model v2 + the National Cybersecurity Strategy + CIRCIA Final Rule 2026 alignment. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does FISMA actually require?
FISMA has 38 controls organised across 6 domains. The largest domains are Agency head responsibilities (44 U.S.C. 3554(a)) – FISMA (14 controls), Agency-wide information security program (44 U.S.C. 3554(b)) – FISMA (9 controls), Annual independent evaluation (44 U.S.C. 3555) – FISMA (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of FISMA do I already cover?
FISMA maps to 87 other compliance frameworks. The top mapping partners are BSI IT-Grundschutz (6% coverage), Vietnam Law on Cybersecurity (No. 116/2025/QH15) (6% coverage), Vermont Data Privacy and Online Surveillance Act (6% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement FISMA?
Start your FISMA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about FISMA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 38 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required