What is FISMA?
FISMA (Federal Information Security Modernization Act) is the US federal law that requires every federal agency to establish, document and have independently evaluated each year an agency-wide, risk-based information security programme covering all information systems used or operated by the agency itself or by a contractor on its behalf. The current law dates from December 2014 and replaced the Federal Information Security Management Act of 2002. The technical detail comes from NIST: the law relies on the FIPS standards and Special Publications, with NIST SP 800-53 as the catalogue of security controls.
FISMA is not a standard that a company gets certified against; it is a legal duty for government. Even so, the law reaches into OT: US federal agencies operate dams, hydroelectric plants, navigation locks, laboratories and thousands of buildings with building automation. Those control systems fall under FISMA too.
🧠 What exactly does FISMA require?
FISMA places responsibility for cybersecurity and information security with the head of each agency and divides the work among a handful of players:
| Role | Task under FISMA |
|---|---|
| Agency head | Ultimately accountable for the security programme and the risks of the agency’s systems |
| CIO and CISO | Set up the programme, assign controls and report status |
| OMB (Office of Management and Budget) | Sets policy, such as Circular A-130, and issues annual FISMA guidance |
| CISA (part of DHS) | Supports implementation, issues binding directives and runs the federal incident reporting centre |
| NIST | Writes the standards and guidelines for non-national security systems |
| Inspector General | Carries out an independent evaluation of the programme every year |
The core obligations are:
- Agency-wide programme - policies, procedures, roles and an up-to-date inventory of all information systems
- Risk assessment - periodically determining what harm a loss of confidentiality, integrity or availability could cause
- Security controls - proportionate to those risks and based on NIST standards
- Training - awareness for staff and contractors
- Incident handling - detection, incident response and reporting to CISA
- Contingency plans - recovery after an outage, including backups
- Annual reporting - to OMB, Congress and the Government Accountability Office (GAO)
🔄 What is the difference between FISMA 2002 and FISMA 2014?
| Feature | FISMA 2002 | FISMA 2014 |
|---|---|---|
| Full name | Federal Information Security Management Act | Federal Information Security Modernization Act |
| Legal basis | Title III of the E-Government Act (Public Law 107-347, 17 December 2002) | Public Law 113-283 (18 December 2014) |
| Emphasis | Documentation and periodic certification | Continuous monitoring and risk-based decisions |
| Role of DHS/CISA | Limited | Implementation and oversight, binding operational directives |
| Incidents | Report to the federal incident centre | Additionally, major incidents reported to Congress within 7 days |
FISMA 2002 was criticised as a paper exercise: agencies wrote thick dossiers every three years while their systems stayed vulnerable in between. The 2014 law shifted attention to current risks, continuous monitoring and a lighter reporting burden. OMB later defined what counts as a “major incident” in memorandum M-17-05.
🔧 How does a FISMA programme work in practice?
Agencies follow the NIST Risk Management Framework described in NIST SP 800-37 (Revision 2, December 2018). It has seven steps:
- Prepare - establish roles, risk strategy and scope
- Categorise - use FIPS 199 to rate the impact (low, moderate or high) on confidentiality, integrity and availability for each system; the highest value sets the category
- Select - choose a control baseline from NIST SP 800-53 Revision 5 and tailor it
- Implement - put the controls in place and record them in a System Security Plan
- Assess - an independent assessor tests the controls in line with SP 800-53A, for example through interviews, inspection and penetration tests
- Authorise - an Authorizing Official accepts the residual risk and grants an Authorization to Operate (ATO)
- Monitor - controls, changes and threats are tracked continuously in line with SP 800-137
The size of the SP 800-53B baselines shows why categorisation matters:
| FIPS 199 impact | SP 800-53B baseline | Typical example |
|---|---|---|
| Low | about 150 controls and enhancements | Public website without sensitive data |
| Moderate | about 290 | Most business applications holding personal data |
| High | about 370 | Systems whose failure affects lives or critical services |
Open weaknesses go into a Plan of Action and Milestones (POA&M), each with an owner and a deadline. The Inspector General rates the programme every year against a five-level maturity model; only level 4, Managed and Measurable, counts as effective.
🏭 What role does FISMA play in OT environments?
FISMA makes no distinction between IT and OT: every information system of a federal agency is in scope. Think of SCADA for dams and hydroelectric plants, PLCs and RTUs in pumping stations, energy management in federal buildings and the control of navigation locks. For these systems NIST SP 800-82 is the key guide. Revision 3, published in September 2023, is titled Guide to Operational Technology (OT) Security and includes an OT overlay for the SP 800-53 Rev. 5 baselines.
That overlay is needed because standard controls play out differently in OT:
- Patching - patches need a maintenance window and vendor approval; compensating controls such as segmentation cover the gap
- Access Control - shared operator accounts and emergency access at the console need a documented exception
- Logging and SIEM - many controllers log very little, so passive network monitoring fills in the picture
- Availability - an automatic lockout after failed passwords can be dangerous in a control room
- Change Management - every change to a control system must also weigh process safety
In addition, CISA’s binding directives require agencies to remediate actively exploited vulnerabilities within fixed deadlines (BOD 22-01).
🧱 Does FISMA apply to suppliers and European companies?
Only indirectly. FISMA applies to federal agencies, and to contractors once they operate an information system on an agency’s behalf or process federal information. The agency then imposes the requirements through the contract. Other situations fall under their own regimes:
- Cloud services for the federal government need a FedRAMP authorisation, which is also based on SP 800-53
- Defence suppliers that process controlled unclassified information on their own systems fall under NIST SP 800-171 and the CMMC programme, not FISMA
- National security systems follow the policies of the Committee on National Security Systems (CNSS)
For a Dutch machine builder or system integrator this means: if you supply SCADA software or control systems to a US federal customer, FISMA requirements reach you through the contract, such as security documentation, vulnerability management and reporting deadlines.
🔍 How does FISMA compare with other frameworks?
| Feature | FISMA | NIST CSF | IEC 62443 | BIO |
|---|---|---|---|---|
| Type | US law | Voluntary framework | International series of standards | Dutch government baseline |
| Applies to | Federal agencies and their contractors | Any organisation | OT asset owners, integrators and suppliers | Dutch government bodies |
| Base document | NIST SP 800-53 and FIPS 199/200 | CSF 2.0 | Zones, conduits and security levels | ISO 27001 and ISO 27002 |
| Assessment | Annual IG evaluation and ATO | Self-assessment | Certification possible | Accountability, statutory since the Cbw |
| OT relevance | Via SP 800-82 Rev. 3 | Medium | Very high | Explicitly covers OT |
The Dutch counterpart is the BIO: BIO2 was adopted on 23 September 2025 and, since the Cybersecurity Act (Cyberbeveiligingswet) entered into force on 15 August 2026, is mandatory by law for the government bodies within its scope. Both frameworks combine a legal duty, a risk-based approach and a fixed control catalogue. One difference is the formal ATO: the BIO has no comparable mandatory per-system authorisation by a single designated official; management accepts risks within the ISMS instead. And whereas NIS2 also covers private essential entities, FISMA is limited to the federal government.
🔐 What can OT teams learn from FISMA?
- Every system has an owner and a risk acceptance - the ATO forces an explicit decision, which is good Governance
- Categorise before you select - not every system needs the heaviest controls; impact sets the baseline
- Documentation as evidence - the Audit trail makes Compliance demonstrable
- Measure continuously - monitoring and annual reassessment instead of a snapshot
- Coherence - FISMA fits well with Zero Trust, Business Continuity and organisation-wide Risk Management
FISMA forces federal agencies into mature Governance and traceable cybersecurity decisions.
❓ Frequently asked questions
What does FISMA stand for?
Since 2014 FISMA stands for the Federal Information Security Modernization Act. The original 2002 law was called the Federal Information Security Management Act. Both require US federal agencies to run an agency-wide information security programme.
Does FISMA apply to Dutch or European companies?
FISMA does not apply directly to Dutch or European companies. A company only faces FISMA requirements when it operates an information system or processes federal information for a US federal agency; those requirements are then set out in the contract.
What is an ATO under FISMA?
An Authorization to Operate (ATO) under FISMA is the formal decision by an Authorizing Official that the residual risk of a system is acceptable. Without an ATO a federal system may not go into production, and the authorisation depends on continuous monitoring.
Which NIST documents belong to FISMA?
The core of FISMA compliance is FIPS 199 for categorisation, FIPS 200 for minimum requirements, NIST SP 800-37 for the Risk Management Framework and NIST SP 800-53 for the controls. For OT systems, NIST SP 800-82 Rev. 3 is added.
Who checks whether an agency complies with FISMA?
FISMA compliance is evaluated every year by each agency’s Inspector General, using metrics issued by OMB and CISA. OMB compiles the results in an annual report to Congress.
Is OT covered by FISMA?
Yes, FISMA covers all information systems of a federal agency, including control systems such as SCADA at dams, hydroelectric plants and buildings. NIST SP 800-82 Rev. 3 describes how agencies apply the SP 800-53 controls to OT.
📌 In summary
FISMA is the US federal law that requires government agencies to run a risk-based, documented and annually evaluated information security programme based on NIST standards.
Since 2014 the emphasis has been on continuous monitoring and incident reporting, with CISA in an operational role. FISMA covers both the IT and the OT of the federal government; suppliers encounter it through contracts. For European organisations FISMA is mainly an instructive example of categorising, authorising and monitoring continuously, comparable to the BIO and NIS2.