C&A keys FISMA

OMB FISMA guidance for 2003

A study of lessons learned from the first year under the Federal Information Security Management Act (FISMA) seems to pinpoint certification and accreditation (C&A) as the most important aspect of compliance.

Federal chief information officers and Office of Management and Budget officials asked the SANS Institute to conduct the study. SANS, a security education organization, hasn't studied all agencies yet, but common themes are already clear, said Alan Paller, director of research at the institute.

Paller expects the full report will be completed and published by December. So far, officials from several of the government's largest departments see C&A as an important factor because "it's an umbrella over the multiple steps" outlined in OMB's FISMA guidance, he said, speaking today at the Federal Information Assurance Conference in College Park, Md.

The guidance focuses on risk assessments, system controls and up-to-date security plans. Each of these steps, and many others, are included in what administrators must check when putting their system through a C&A process.

Agencies are spending anywhere from $25,000 to $400,000 per system on C&A, but responses also show that one of the best ways to cut down on that cost is to implement a continuous vulnerability monitoring and elimination program, Paller said. At one agency, a program that addresses security problems as they arise instead of waiting for an annual evaluation reduced the C&A cost to $5,500 per system, he said.

CIOs should work with agency inspectors general and the General Accounting Office instead of against them, agency and OMB officials told institute officials. FISMA requires agency CIOs and inspectors general to report annually to Congress and OMB; oversight officials are starting to look at inspector general reports as more reliable than those of CIOs, Paller said.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.