C&A keys FISMA

OMB FISMA guidance for 2003

A study of lessons learned from the first year under the Federal Information Security Management Act (FISMA) seems to pinpoint certification and accreditation (C&A) as the most important aspect of compliance.

Federal chief information officers and Office of Management and Budget officials asked the SANS Institute to conduct the study. SANS, a security education organization, hasn't studied all agencies yet, but common themes are already clear, said Alan Paller, director of research at the institute.

Paller expects the full report will be completed and published by December. So far, officials from several of the government's largest departments see C&A as an important factor because "it's an umbrella over the multiple steps" outlined in OMB's FISMA guidance, he said, speaking today at the Federal Information Assurance Conference in College Park, Md.

The guidance focuses on risk assessments, system controls and up-to-date security plans. Each of these steps, and many others, are included in what administrators must check when putting their system through a C&A process.

Agencies are spending anywhere from $25,000 to $400,000 per system on C&A, but responses also show that one of the best ways to cut down on that cost is to implement a continuous vulnerability monitoring and elimination program, Paller said. At one agency, a program that addresses security problems as they arise instead of waiting for an annual evaluation reduced the C&A cost to $5,500 per system, he said.

CIOs should work with agency inspectors general and the General Accounting Office instead of against them, agency and OMB officials told institute officials. FISMA requires agency CIOs and inspectors general to report annually to Congress and OMB; oversight officials are starting to look at inspector general reports as more reliable than those of CIOs, Paller said.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.