FISMA reform would elevate White House's cyber authority

Changes passed as part of Defense bill

The changes to the 2002 Federal Information Security Management Act that passed as part of the House’s Defense Authorization Bill for fiscal 2011 would give the White House more direct control over IT security within agencies.

Rather than setting out static requirements to be met by agencies in securing their information systems, the Federal Information Security Amendment Act of 2010 would establish a National Office for Cyberspace in the Executive Office of the President, with a director who would be confirmed by the Senate, to oversee IT security.

“The Office shall serve as the principal office for coordinating issues relating to achieving an assured, reliable, secure and survivable information infrastructure and related capabilities for the Federal Government,” the amendment reads.

Among the minimum requirements would be continuous monitoring of the status of IT systems, a technology recently added to FISMA requirements through administrative changes. The director of the office would require Senate confirmation—unlike the federal chief technology officer and chief information officer positions—but would lack the budget authority that many FISMA reform proponents insist is necessary.


Related stories

FISMA reform rides on defense spending's coattails

Next steps for continuous network monitoring

NASA's new FISMA approach and what it means for you

FISMA gets the tools to do the job


Under the amendment the director would review agency information security budgets, but would only offer nonbinding approval or disapproval of agency annual budgets before they go to the Office of Management and Budget, which now oversees FISMA compliance. The director would allow to offer recommendations for correcting perceived problems.

The Cyberspace Office would be supported by a Federal Cybersecurity Practice Board that would develop policies and procedures concerning:

  • Minimum security controls to provide a baseline of protection
  • Measures of effectiveness to provide metrics for minimum controls
  • Criteria for commercial products and services used by agencies to meet minimum controls
  • Remedies for deficiencies in minimum controls and
  • Cooperation with industry and foreign nations on information security issues.

The amendment also would create an Office of Chief Technology Officer in the White House. The federal CTO would be a member of the Domestic Policy Council, but Senate approval would not be required. The CTO would assess overall federal IT conditions and advise the president, lead interagency efforts to implement best practices and best-in-class technology, encourage innovation and adoption of technology, and work with the private sector. The CTO also would publish annual report that would be specifically required to appear on the CTO’s Web site as well as in the Federal Register.

The office would be separate from the federal CTO position that the Obama administration created and which Aneesh Chopra holds. The amendment does not address what would become of that position.

The amendment would repeal the existing chapters of FISMA and replace them with a streamlined version. As with the original FISMA, it acknowledges that “commercially developed information security products offer advanced, dynamic, robust and effective information security solutions,” and is technology neutral in that it does not specify products or tools to achieve goals. As under current legislation, security standards and specifications would be developed by the National Institute of Standards and Technology, with assistance from the National Security Agency, the Defense Department and other agencies.

Also as in current law, the requirements do not apply to national security systems, which would be under the oversight of the secretary of Defense and the CIA director.

Beyond establishing minimum controls, agency heads would be responsible for assuring the information security within their agencies, using a risk-based approach and integrating security into agency mission and planning.

“Each agency shall develop, document, and implement an agencywide information security program approved by the Director of the National Office for Cyberspace,” the amendment says. The plans would include continuous automated technical monitoring of the information infrastructure, testing to assure that security controls are commensurate with risk, and policies to mitigate and correct risks. In general, agencies would automate practices and evaluations to the extent possible.

The director of the Cyberspace Office also “shall ensure the operation of a central federal information security incident center,” that will gather information from and offer operational help to agencies. Agencies must notify the center of security incidents, as well as the National Cyber Investigative Joint Task Force and agency inspectors general.

Operators of national security system will share threat, vulnerability and incident information with center, “to the extent consistent with standards and guidelines for national security systems.”

Annual audits of security policies and practicies, either by an agency IG or an independent auditor, would be required, and all IT acquisitions and contracts would have to include requirements for adequate security. NIST, the General Services Administration, and the Cyberspace Office would oversee minimum requirements for products and product evaluations.

 

About the Author

William Jackson is a Maryland-based freelance writer.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group