The Federal Information Security Management Act of 2002 (FISMA) is part of the Homeland Security Act of 2002. FISMA assigns the oversight of executive branch agency information security policies and practices to the Director of the Office of Management and Budget (OMB). The Act lists several authorities, duties, and functions of the OMB Director:

Promulgate information security standards;
Oversee information security policies, standards, and guidelines implementation;
Implement "information security protections commensurate with the risk and magnitude of the harm" that may result from risks to federal information systems;
Coordinate the development of standards and guidelines to assure that standards and guidelines corolate to standards and guidelines developed to protect national security systems; and
Oversee agency comliance with standards and guidelines;

In developing standards for federal informaiton security systems, the OMB Director, in consultation with the Secretary of Homeland Security, shall promulgate standards developed by the National Institute of Standards and Technology (NIST) that are the minimum security controls necessary to address cyber risks. The Director may also promulgate standards that are necessary to improve information systems efficiency, security, or operation. The OMB/NIST's standards are compulsory and binding for federal agencies.

FISMA also requires each agency to create an agency-wide information security program approved by the OMB Director. The agency shall conduct annual independent evaluations of the effectiveness of its information security program.

The Act assigns the task of developing minimum security requirements and guidelines for any information system used or operated by an agency, an organization on behalf of an agency, or a contractor of an agency. The standards may not require specific technological controls, hardware, or software. The goal is for NIST/OMB's standards to provide sufficient flexibility of requirements based on the risk to the informaiton system. Agencies should permit, to the greatest extent possible, the use of off-the-shelf commercially developed information security products.

​

Cybersecurity Statutes

Advancing American AI Act

Privacy Policy | Terms of Use | Legal | Contact