C&A keys FISMA

OMB FISMA guidance for 2003

A study of lessons learned from the first year under the Federal Information Security Management Act (FISMA) seems to pinpoint certification and accreditation (C&A) as the most important aspect of compliance.

Federal chief information officers and Office of Management and Budget officials asked the SANS Institute to conduct the study. SANS, a security education organization, hasn't studied all agencies yet, but common themes are already clear, said Alan Paller, director of research at the institute.

Paller expects the full report will be completed and published by December. So far, officials from several of the government's largest departments see C&A as an important factor because "it's an umbrella over the multiple steps" outlined in OMB's FISMA guidance, he said, speaking today at the Federal Information Assurance Conference in College Park, Md.

The guidance focuses on risk assessments, system controls and up-to-date security plans. Each of these steps, and many others, are included in what administrators must check when putting their system through a C&A process.

Agencies are spending anywhere from $25,000 to $400,000 per system on C&A, but responses also show that one of the best ways to cut down on that cost is to implement a continuous vulnerability monitoring and elimination program, Paller said. At one agency, a program that addresses security problems as they arise instead of waiting for an annual evaluation reduced the C&A cost to $5,500 per system, he said.

CIOs should work with agency inspectors general and the General Accounting Office instead of against them, agency and OMB officials told institute officials. FISMA requires agency CIOs and inspectors general to report annually to Congress and OMB; oversight officials are starting to look at inspector general reports as more reliable than those of CIOs, Paller said.

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.