C&A keys FISMA

OMB FISMA guidance for 2003

A study of lessons learned from the first year under the Federal Information Security Management Act (FISMA) seems to pinpoint certification and accreditation (C&A) as the most important aspect of compliance.

Federal chief information officers and Office of Management and Budget officials asked the SANS Institute to conduct the study. SANS, a security education organization, hasn't studied all agencies yet, but common themes are already clear, said Alan Paller, director of research at the institute.

Paller expects the full report will be completed and published by December. So far, officials from several of the government's largest departments see C&A as an important factor because "it's an umbrella over the multiple steps" outlined in OMB's FISMA guidance, he said, speaking today at the Federal Information Assurance Conference in College Park, Md.

The guidance focuses on risk assessments, system controls and up-to-date security plans. Each of these steps, and many others, are included in what administrators must check when putting their system through a C&A process.

Agencies are spending anywhere from $25,000 to $400,000 per system on C&A, but responses also show that one of the best ways to cut down on that cost is to implement a continuous vulnerability monitoring and elimination program, Paller said. At one agency, a program that addresses security problems as they arise instead of waiting for an annual evaluation reduced the C&A cost to $5,500 per system, he said.

CIOs should work with agency inspectors general and the General Accounting Office instead of against them, agency and OMB officials told institute officials. FISMA requires agency CIOs and inspectors general to report annually to Congress and OMB; oversight officials are starting to look at inspector general reports as more reliable than those of CIOs, Paller said.

Featured

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

  • FCW Illustration.  Original Images: Shutterstock, Airbnb

    Should federal contracting be more like Airbnb?

    Steve Kelman believes a lighter touch and a bit more trust could transform today's compliance culture.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.